{
  "@id": "urn:uuid:37fda886-316e-4b53-bec4-887761e38468",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T10:12:46.442569+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T05:10:28.546830+00:00",
      "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25270"
      },
      "impact_statement": "not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:46.442569+00:00",
      "status_notes": "Vulnerability CVE-2022-25271 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2022-25271 is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerable code pattern (missing type check for 'value' form elements) was fixed in the upstream Drupal release before version 10.5.12 was published. The target code contains an enhanced version of the fix that checks `!in_array($element['#type'], ['item', 'value'], TRUE)` before processing form input, preventing attackers from overwriting protected 'value' and 'item' type form elements. This fix was included in the upstream Drupal 10.5.12 release that TuxCare onboarded in July 2026.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25271"
      },
      "impact_statement": "CVE-2022-25271 is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerable code pattern (missing type check for 'value' form elements) was fixed in the upstream Drupal release before version 10.5.12 was published. The target code contains an enhanced version of the fix that checks `!in_array($element['#type'], ['item', 'value'], TRUE)` before processing form input, preventing attackers from overwriting protected 'value' and 'item' type form elements. This fix was included in the upstream Drupal 10.5.12 release that TuxCare onboarded in July 2026."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2022-25273 does not affect version 10.5.12-p1+tuxcare of drupal/core. Target Drupal 10.5.12 includes the upstream fix for CVE-2022-25273/SA-CORE-2022-008. The vulnerable code pattern (checking only `$element['#type'] !== 'value'`) is not present. The target has the fixed pattern at FormBuilder.php:1225 that excludes both 'item' and 'value' types from input processing: `!in_array($element['#type'], ['item', 'value'], TRUE)`. This prevents attackers from injecting values into display-only form elements. The fix was included in upstream Drupal 10.5.12 when it was released, and was imported via TuxCare's onboarding snapshot commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25273"
      },
      "impact_statement": "Target Drupal 10.5.12 includes the upstream fix for CVE-2022-25273/SA-CORE-2022-008. The vulnerable code pattern (checking only `$element['#type'] !== 'value'`) is not present. The target has the fixed pattern at FormBuilder.php:1225 that excludes both 'item' and 'value' types from input processing: `!in_array($element['#type'], ['item', 'value'], TRUE)`. This prevents attackers from injecting values into display-only form elements. The fix was included in upstream Drupal 10.5.12 when it was released, and was imported via TuxCare's onboarding snapshot commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2022-25275 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2022-25275 is not present in Drupal 10.5.12-p2+tuxcare. The fix for SA-CORE-2022-012 (released July 2022) was already included in the upstream Drupal 10.5.12 release. All three defensive mechanisms from the security patch are present: (1) ImageStyleDownloadController properly determines public vs non-public schemes and invokes access control hooks for non-public schemes, (2) PublicStream prevents path confusion where public:// URIs resolve to private directories, and (3) system_file_download grants access to additional public schemes. The fix was onboarded via snapshot commit b5de532105c by bashebr@cloudlinux.com on 2026-07-16.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25275"
      },
      "impact_statement": "CVE-2022-25275 is not present in Drupal 10.5.12-p2+tuxcare. The fix for SA-CORE-2022-012 (released July 2022) was already included in the upstream Drupal 10.5.12 release. All three defensive mechanisms from the security patch are present: (1) ImageStyleDownloadController properly determines public vs non-public schemes and invokes access control hooks for non-public schemes, (2) PublicStream prevents path confusion where public:// URIs resolve to private directories, and (3) system_file_download grants access to additional public schemes. The fix was onboarded via snapshot commit b5de532105c by bashebr@cloudlinux.com on 2026-07-16."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T01:56:43.326000+00:00",
      "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25276"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2022-25277 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2022-25277. The SA-CORE-2022-014 security fix was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS and INSECURE_EXTENSION_REGEX in FileSystemInterface.php, and (2) adding special handling in SecurityFileUploadEventSubscriber.php to detect dot-prefixed insecure extension files like .htaccess and properly sanitize them. The fix was authored by xjm@65776.no-reply.drupal.org in July 2022 and shipped with the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25277"
      },
      "impact_statement": "The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2022-25277. The SA-CORE-2022-014 security fix was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS and INSECURE_EXTENSION_REGEX in FileSystemInterface.php, and (2) adding special handling in SecurityFileUploadEventSubscriber.php to detect dot-prefixed insecure extension files like .htaccess and properly sanitize them. The fix was authored by xjm@65776.no-reply.drupal.org in July 2022 and shipped with the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25278"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2023-5256 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2023-5256 (SA-CORE-2023-006) is NOT present in target Drupal 10.5.12-p2+tuxcare. The vulnerability involved JSON:API module error responses leaking sensitive information (backtraces with file paths, line numbers) to unauthorized users via cacheable responses. The fix requires BOTH \"access site reports\" permission AND verbose error reporting config (previously only checked permission), and prevents caching of verbose errors. All three fix components are present in HEAD at modules/jsonapi/src/Normalizer/HttpExceptionNormalizer.php: cache tag added (line 48), cache max-age set to 0 for verbose mode (line 50), and double authorization check (line 94). The fix was already present in upstream Drupal 10.5.12 release when TuxCare onboarded it via snapshot commit b5de532105. No TuxCare backport to 10.5.12 was needed (backport 4973c83e91 was only for version 8.9.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-5256"
      },
      "impact_statement": "CVE-2023-5256 (SA-CORE-2023-006) is NOT present in target Drupal 10.5.12-p2+tuxcare. The vulnerability involved JSON:API module error responses leaking sensitive information (backtraces with file paths, line numbers) to unauthorized users via cacheable responses. The fix requires BOTH \"access site reports\" permission AND verbose error reporting config (previously only checked permission), and prevents caching of verbose errors. All three fix components are present in HEAD at modules/jsonapi/src/Normalizer/HttpExceptionNormalizer.php: cache tag added (line 48), cache max-age set to 0 for verbose mode (line 50), and double authorization check (line 94). The fix was already present in upstream Drupal 10.5.12 release when TuxCare onboarded it via snapshot commit b5de532105. No TuxCare backport to 10.5.12 was needed (backport 4973c83e91 was only for version 8.9.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-12393"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-45440"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:43.097163+00:00",
      "status_notes": "Vulnerability CVE-2024-55634 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target is not affected by CVE-2024-55634. The vulnerability (database-collation-dependent case sensitivity in uniqueness validation allowing duplicate user emails differing only by case) was fixed in upstream Drupal 10.5.12 via commit 13e9e9e182 (SA-CORE-2024-004) by Dave Long. TuxCare imported this already-fixed version as snapshot b5de532105. All four security patches are present: UniqueFieldConstraint has $caseSensitive=FALSE, UniqueFieldValueValidator implements case-insensitive LIKE queries, FileUriUnique sets $caseSensitive=TRUE, and user.install detects conflicting emails. This is an upstream fix, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55634"
      },
      "impact_statement": "The target is not affected by CVE-2024-55634. The vulnerability (database-collation-dependent case sensitivity in uniqueness validation allowing duplicate user emails differing only by case) was fixed in upstream Drupal 10.5.12 via commit 13e9e9e182 (SA-CORE-2024-004) by Dave Long. TuxCare imported this already-fixed version as snapshot b5de532105. All four security patches are present: UniqueFieldConstraint has $caseSensitive=FALSE, UniqueFieldValueValidator implements case-insensitive LIKE queries, FileUriUnique sets $caseSensitive=TRUE, and user.install detects conflicting emails. This is an upstream fix, not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2024-55636 does not affect version 10.5.12-p1+tuxcare of drupal/core. Target Drupal 10.5.12 is NOT affected by CVE-2024-55636. The vulnerability requires the absence of a type declaration on the $targetCacheStorage property in StorageComparer.php to enable a PHP object injection gadget chain leading to arbitrary file deletion. The target contains the fix: line 89 declares 'protected CacheBackendInterface $targetCacheStorage;' which causes PHP to throw TypeError when incompatible objects are assigned during unserialize(), breaking the attack chain. This fix was authored by the upstream Drupal project (Dave Long) in commit 9f46c64eec (SA-CORE-2024-006, Nov 2024) and shipped in the upstream Drupal 10.5.12 release (Jun 2026). TuxCare imported this already-fixed release via snapshot commit b5de532105 (Jul 2026).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55636"
      },
      "impact_statement": "Target Drupal 10.5.12 is NOT affected by CVE-2024-55636. The vulnerability requires the absence of a type declaration on the $targetCacheStorage property in StorageComparer.php to enable a PHP object injection gadget chain leading to arbitrary file deletion. The target contains the fix: line 89 declares 'protected CacheBackendInterface $targetCacheStorage;' which causes PHP to throw TypeError when incompatible objects are assigned during unserialize(), breaking the attack chain. This fix was authored by the upstream Drupal project (Dave Long) in commit 9f46c64eec (SA-CORE-2024-006, Nov 2024) and shipped in the upstream Drupal 10.5.12 release (Jun 2026). TuxCare imported this already-fixed release via snapshot commit b5de532105 (Jul 2026)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2024-55637 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2024-55637 (SA-CORE-2024-007) is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerability involved a PHP Object Injection gadget chain in ViewExecutable::$query that lacked type constraints. The fix adds a strict type declaration (`?QueryPluginBase`) to the $query property, preventing arbitrary type injection during unserialization. This fix was already included in the upstream Drupal 10.5.12 release (published after SA-CORE-2024-007 on 2024-11-20) and was onboarded by TuxCare via snapshot commit b5de532105cf in July 2026. No separate TuxCare backport was needed. The target code at line 223 of ViewExecutable.php contains the fixed version: `public ?QueryPluginBase $query = NULL;`",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55637"
      },
      "impact_statement": "CVE-2024-55637 (SA-CORE-2024-007) is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerability involved a PHP Object Injection gadget chain in ViewExecutable::$query that lacked type constraints. The fix adds a strict type declaration (`?QueryPluginBase`) to the $query property, preventing arbitrary type injection during unserialization. This fix was already included in the upstream Drupal 10.5.12 release (published after SA-CORE-2024-007 on 2024-11-20) and was onboarded by TuxCare via snapshot commit b5de532105cf in July 2026. No separate TuxCare backport was needed. The target code at line 223 of ViewExecutable.php contains the fixed version: `public ?QueryPluginBase $query = NULL;`"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2024-55638 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2024-55638. All three defensive fixes from the upstream patch (SA-CORE-2024-008) are already present in the target: (1) Select.php validates that internal properties (fields, expressions, tables, order, group, union) are arrays before string conversion; (2) Update.php validates fields, arguments, and expressionFields are arrays; (3) StatementPrefetch.php allowlists database drivers before reflection-based instantiation with constructor arguments. These defenses prevent deserialized objects with corrupted internal state from being used to achieve arbitrary code execution. The fix was included in the upstream Drupal 10.5.12 release (authored by dave@longwaveconsulting.com, committed 2024-11-20) before TuxCare onboarded it via snapshot commit b5de532105 on 2026-07-16. Since the fix came with the upstream release, the vulnerable code pattern was never present in this TuxCare-maintained version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55638"
      },
      "impact_statement": "The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2024-55638. All three defensive fixes from the upstream patch (SA-CORE-2024-008) are already present in the target: (1) Select.php validates that internal properties (fields, expressions, tables, order, group, union) are arrays before string conversion; (2) Update.php validates fields, arguments, and expressionFields are arrays; (3) StatementPrefetch.php allowlists database drivers before reflection-based instantiation with constructor arguments. These defenses prevent deserialized objects with corrupted internal state from being used to achieve arbitrary code execution. The fix was included in the upstream Drupal 10.5.12 release (authored by dave@longwaveconsulting.com, committed 2024-11-20) before TuxCare onboarded it via snapshot commit b5de532105 on 2026-07-16. Since the fix came with the upstream release, the vulnerable code pattern was never present in this TuxCare-maintained version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13080"
      },
      "impact_statement": "not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13081"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13082"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:16:38.201074+00:00",
      "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13083"
      },
      "impact_statement": "not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:16:38.201074+00:00",
      "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-3057"
      },
      "impact_statement": "not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31673"
      },
      "impact_statement": "not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T21:18:55.288253+00:00",
      "status_notes": "Vulnerability CVE-2025-31674 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target Drupal 10.5.12 repository is NOT AFFECTED by CVE-2025-31674. The vulnerability (object injection via missing type validation in DisplayPluginCollection::clear()) has already been fixed in the upstream Drupal 10.5.12 release. The fix adds an instanceof DisplayPluginInterface check before calling destroy() on objects in the plugin collection, preventing arbitrary method invocation on injected objects. This fix was part of SA-CORE-2025-003 and was already present when TuxCare onboarded the 10.5.12 release via snapshot commit b5de532105.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31674"
      },
      "impact_statement": "The target Drupal 10.5.12 repository is NOT AFFECTED by CVE-2025-31674. The vulnerability (object injection via missing type validation in DisplayPluginCollection::clear()) has already been fixed in the upstream Drupal 10.5.12 release. The fix adds an instanceof DisplayPluginInterface check before calling destroy() on objects in the plugin collection, preventing arbitrary method invocation on injected objects. This fix was part of SA-CORE-2025-003 and was already present when TuxCare onboarded the 10.5.12 release via snapshot commit b5de532105."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31675"
      },
      "impact_statement": "not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:21:00.073652+00:00",
      "status_notes": "Vulnerability CVE-2026-108097 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-108097"
      },
      "action_statement": "Vulnerability CVE-2026-108097 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:21:00.073652+00:00",
      "status_notes": "Vulnerability CVE-2026-108514 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-108514"
      },
      "action_statement": "Vulnerability CVE-2026-108514 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:21:00.073652+00:00",
      "status_notes": "Vulnerability CVE-2026-108515 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-108515"
      },
      "action_statement": "Vulnerability CVE-2026-108515 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-01T16:33:11.394606+00:00",
      "status_notes": "Vulnerability CVE-2026-15916 is fixed in version 10.5.12-p1+tuxcare of drupal/core.",
      "vulnerability": {
        "name": "CVE-2026-15916"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-01T16:33:11.394606+00:00",
      "status_notes": "Vulnerability CVE-2026-55805 is fixed in version 10.5.12-p1+tuxcare of drupal/core.",
      "vulnerability": {
        "name": "CVE-2026-55805"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:16:38.201074+00:00",
      "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6365"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6366"
      },
      "impact_statement": "not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T21:16:06.652991+00:00",
      "status_notes": "Vulnerability CVE-2026-9082 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2026-9082 (SA-CORE-2026-004) is a SQL injection vulnerability in Drupal core's entity query system that allows attackers to inject malicious SQL via associative array keys in query conditions. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT affected because the upstream fix was already present in Drupal 10.5.12 when TuxCare onboarded that version. All three vulnerable files (Condition.php, ConditionAggregate.php, pgsql/Condition.php) contain the array_values() fix that prevents string keys from being used in SQL placeholder construction. The vulnerable code pattern never existed in this released version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9082"
      },
      "impact_statement": "CVE-2026-9082 (SA-CORE-2026-004) is a SQL injection vulnerability in Drupal core's entity query system that allows attackers to inject malicious SQL via associative array keys in query conditions. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT affected because the upstream fix was already present in Drupal 10.5.12 when TuxCare onboarded that version. All three vulnerable files (Condition.php, ConditionAggregate.php, pgsql/Condition.php) contain the array_values() fix that prevents string keys from being used in SQL placeholder construction. The vulnerable code pattern never existed in this released version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6ccv-8fgf-cjpw"
      },
      "impact_statement": "not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f..."
    }
  ]
}