{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:67eb36ec-fec4-5215-8010-810c0ecc5849", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "keras", "purl": "pkg:pypi/keras@2.15.0.post4+tuxcare", "type": "library", "bom-ref": "pkg:pypi/keras@2.15.0.post4+tuxcare", "version": "2.15.0.post4+tuxcare", "pedigree": { "ancestors": [ { "name": "keras", "purl": "pkg:pypi/keras@2.15.0", "type": "library", "version": "2.15.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-3660", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:8196855d-ed82-5ff4-ab66-1cd8ae2724f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3660 is fixed in version 2.15.0.post4+tuxcare of keras." } }, { "id": "CVE-2024-55459", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:bdd8557c-b806-53e2-9169-8318d1ca321a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-55459 is fixed in version 2.15.0.post4+tuxcare of keras." } }, { "id": "CVE-2025-12058", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:adc1c770-1f4f-5496-8ec1-97c8034acfd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12058 affects version 2.15.0.post4+tuxcare of keras, and is fixed in 2.15.0.post5+tuxcare." } }, { "id": "CVE-2025-12060", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:3bb12ee2-8a9f-5786-973b-5920d339f80b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12060 is fixed in version 2.15.0.post4+tuxcare of keras." } }, { "id": "CVE-2025-12638", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:cd930e88-482e-5fd6-ba25-a296584de5cf", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-12638 is a false positive for keras 2.15.0.post4+tuxcare." } }, { "id": "CVE-2025-9906", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:ee9b20dd-061e-549c-8793-e1f5fd02e482", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-9906 does not affect version 2.15.0.post4+tuxcare of keras. keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02", "justification": "code_not_present" } }, { "id": "CVE-2026-0897", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:2cfad9e5-b238-55d1-af31-8d8de505badd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-0897 does not affect version 2.15.0.post4+tuxcare of keras. keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02", "justification": "code_not_present" } }, { "id": "CVE-2026-11816", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:ad510f80-ecc2-5e46-a940-86b08eca46a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-11816 is fixed in version 2.15.0.post4+tuxcare of keras." } }, { "id": "CVE-2026-12479", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:8327f85c-957a-55fc-973e-6483fd705786", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-12479 does not affect version 2.15.0.post4+tuxcare of keras. keras 2.15.0 builds DiskIOStore asset paths only from Python attribute names (dir(trackable)) and snake_case class names, never from the user-controlled layer name (saving_lib._save/_load_container_state explicitly avoid trackable.name). Verified 09.11.2026: layers named '..', '../../escape', '..\\x' save/load with asset path 'layers/string_lookup'. Upstream keras 3.x traversal via layer name does not apply. Bot MR keras!8 closed.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-12480", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:3c1ff358-b648-56ce-8365-2af965959d14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-12480 affects version 2.15.0.post4+tuxcare of keras, and is fixed in 2.15.0.post5+tuxcare." } }, { "id": "CVE-2026-12481", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:885bc413-fc0f-5519-90e6-37af766964df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-12481 is fixed in version 2.15.0.post4+tuxcare of keras." } }, { "id": "CVE-2026-12482", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c8452eb5-dfc7-5014-8d17-f49947fbed58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-12482 affects version 2.15.0.post4+tuxcare of keras, and is fixed in 2.15.0.post5+tuxcare." } }, { "id": "CVE-2026-12484", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:e41e4936-2641-5fe5-991e-4edefe6f700d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-12484 does not affect version 2.15.0.post4+tuxcare of keras. keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02", "justification": "code_not_present" } }, { "id": "CVE-2026-12570", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:8bce5113-66b8-56bb-96e9-676ecfc83604", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-12570 is fixed in version 2.15.0.post4+tuxcare of keras." } }, { "id": "CVE-2026-1462", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:e40eef6f-6cfd-559f-824e-cb900af03985", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1462 does not affect version 2.15.0.post4+tuxcare of keras. Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462", "justification": "code_not_present" } }, { "id": "CVE-2026-9335", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:99e42ca3-a17f-57b8-88b4-7a77b9396087", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9335 affects version 2.15.0.post4+tuxcare of keras, and is fixed in 2.15.0.post5+tuxcare." } }, { "id": "GHSA-28jp-44vh-q42h", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:ca75d91a-3652-5ac8-8929-6e7341d2541f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-28jp-44vh-q42h is a false positive for keras 2.15.0.post4+tuxcare." } }, { "id": "GHSA-5478-v2w6-c6q7", "affects": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:505a64cf-f7ea-5076-a37c-a73130d25f14", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-5478-v2w6-c6q7 is a false positive for keras 2.15.0.post4+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/keras@2.15.0.post4+tuxcare" } ] }