{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fd3e3772-3bbb-509e-b302-133aef0259de", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "keras", "purl": "pkg:pypi/keras@2.15.0.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/keras@2.15.0.post5+tuxcare", "version": "2.15.0.post5+tuxcare", "pedigree": { "ancestors": [ { "name": "keras", "purl": "pkg:pypi/keras@2.15.0", "type": "library", "version": "2.15.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-3660", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:ac6935b9-ea7f-520e-b890-2e962bcaed7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3660 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2024-55459", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:ad131f75-e186-512d-8226-46d036b96fcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-55459 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2025-12058", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:19fbd213-f3d7-5f30-912f-fc3c21a4fe9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12058 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2025-12060", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b88e9e93-f96e-5ba5-8252-46d9feae73f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12060 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2025-12638", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:4e2090c9-7833-5ddb-8ab5-86bfeed533d3", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-12638 is a false positive for keras 2.15.0.post5+tuxcare." } }, { "id": "CVE-2025-9906", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:26b711e2-c5c4-5754-8a64-682c9dfe6fe0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-9906 does not affect version 2.15.0.post5+tuxcare of keras. keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02", "justification": "code_not_present" } }, { "id": "CVE-2026-0897", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:956269a2-c31f-5374-9439-454fa887eb78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-0897 does not affect version 2.15.0.post5+tuxcare of keras. keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02", "justification": "code_not_present" } }, { "id": "CVE-2026-11816", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:957fe336-5a66-5ed3-b46c-f9f833ab760e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-11816 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2026-12479", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1be62ea9-527e-5859-9bfe-b21f7fea0f52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-12479 does not affect version 2.15.0.post5+tuxcare of keras. keras 2.15.0 builds DiskIOStore asset paths only from Python attribute names (dir(trackable)) and snake_case class names, never from the user-controlled layer name (saving_lib._save/_load_container_state explicitly avoid trackable.name). Verified 09.11.2026: layers named '..', '../../escape', '..\\x' save/load with asset path 'layers/string_lookup'. Upstream keras 3.x traversal via layer name does not apply. Bot MR keras!8 closed.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-12480", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:3d302504-1093-56ba-bcfd-1364b9a6cd66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-12480 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2026-12481", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:4ae48dd5-70e7-5ad2-8282-c3c7cc12965c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-12481 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2026-12482", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:8f2290e6-536d-58e5-8b3b-85fdeb90d154", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-12482 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2026-12484", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:7e80f0ee-910b-58b5-bcb6-2065e6f09fd3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-12484 does not affect version 2.15.0.post5+tuxcare of keras. keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02", "justification": "code_not_present" } }, { "id": "CVE-2026-12570", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9bc82f04-d3eb-56a9-abd8-74c0dbffb797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-12570 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "CVE-2026-1462", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:c5c9619c-b0ce-564f-bba8-b39b5665d84f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1462 does not affect version 2.15.0.post5+tuxcare of keras. Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462", "justification": "code_not_present" } }, { "id": "CVE-2026-9335", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:cc93ee42-ac65-51c2-ae9b-64153f7496c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-9335 is fixed in version 2.15.0.post5+tuxcare of keras." } }, { "id": "GHSA-28jp-44vh-q42h", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:89a88bc7-633c-5098-8d8a-ec09383a34a5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-28jp-44vh-q42h is a false positive for keras 2.15.0.post5+tuxcare." } }, { "id": "GHSA-5478-v2w6-c6q7", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:c589ea64-a2fd-5239-a11a-d85d29ac9cc4", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-5478-v2w6-c6q7 is a false positive for keras 2.15.0.post5+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/keras@2.15.0.post5+tuxcare" } ] }