{
  "@id": "urn:uuid:8293ba39-905a-4336-b470-af41674012c1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T10:12:46.442569+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T05:10:28.546830+00:00",
      "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is NOT AFFECTED by CVE-2022-25270. The vulnerable QuickEdit module was completely removed from Drupal 10.x before version 10.0.0 was released (removed on 2022-08-29, Drupal 10.0.0 released 2022-12-15). The target contains zero QuickEdit files; the vulnerable file `modules/quickedit/src/MetadataGenerator.php` does not exist. This satisfies Rule 5 Type A1: the INPUT type...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25270"
      },
      "impact_statement": "not_affected \u2014 The target Drupal 10.6.17 is NOT AFFECTED by CVE-2022-25270. The vulnerable QuickEdit module was completely removed from Drupal 10.x before version 10.0.0 was released (removed on 2022-08-29, Drupal 10.0.0 released 2022-12-15). The target contains zero QuickEdit files; the vulnerable file `modules/quickedit/src/MetadataGenerator.php` does not exist. This satisfies Rule 5 Type A1: the INPUT type..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:46.442569+00:00",
      "status_notes": "Vulnerability CVE-2022-25271 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2022-25271 is not present in the target. The vulnerability allowed attackers to overwrite developer-controlled data in form elements of type 'value' by submitting crafted form data. The upstream Drupal vendor fixed this in SA-CORE-2022-003 (Feb 2022) by excluding 'value' type elements from user input processing, and enhanced it in SA-CORE-2022-008 (Apr 2022) to also exclude 'item' type elements. The fix was already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The target code at lib/Drupal/Core/Form/FormBuilder.php:1225 contains the defense: !in_array($element['#type'], ['item', 'value'], TRUE), which prevents all user input processing for these element types.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25271"
      },
      "impact_statement": "CVE-2022-25271 is not present in the target. The vulnerability allowed attackers to overwrite developer-controlled data in form elements of type 'value' by submitting crafted form data. The upstream Drupal vendor fixed this in SA-CORE-2022-003 (Feb 2022) by excluding 'value' type elements from user input processing, and enhanced it in SA-CORE-2022-008 (Apr 2022) to also exclude 'item' type elements. The fix was already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The target code at lib/Drupal/Core/Form/FormBuilder.php:1225 contains the defense: !in_array($element['#type'], ['item', 'value'], TRUE), which prevents all user input processing for these element types."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2022-25273 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2022-25273 (SA-CORE-2022-008) describes a Drupal form API vulnerability where form elements with #type='item' could have their values improperly overwritten by attackers. The upstream fix adds 'item' to the list of element types excluded from input processing. This fix was already present in upstream Drupal 10.6.17 (released September 2026), which TuxCare onboarded as the base for this version. The vulnerable code pattern does not exist in the target; the fix is present at lib/Drupal/Core/Form/FormBuilder.php:1224-1226.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25273"
      },
      "impact_statement": "CVE-2022-25273 (SA-CORE-2022-008) describes a Drupal form API vulnerability where form elements with #type='item' could have their values improperly overwritten by attackers. The upstream fix adds 'item' to the list of element types excluded from input processing. This fix was already present in upstream Drupal 10.6.17 (released September 2026), which TuxCare onboarded as the base for this version. The vulnerable code pattern does not exist in the target; the fix is present at lib/Drupal/Core/Form/FormBuilder.php:1224-1226."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2022-25275 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2022-25275 (SA-CORE-2022-012) is NOT present in the target. The security fix was committed to Drupal core on July 20, 2022, and Drupal 10.6.17 was released on September 16, 2026\u2014over 4 years later. The upstream release already includes the fix. Code inspection confirms all three fix components are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` to enforce access control on all non-public schemes (not just 'private'), (2) PublicStream.php has `getLocalPath()` override preventing access to files in private directories, and (3) system.module implements `system_file_download()` hook granting access to additional public schemes. The vulnerable pattern (checking only `$scheme == 'private'`) is absent; the fixed pattern (checking `!$is_public`) is present. This is an upstream vendor fix that shipped with the Drupal 10.6.17 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25275"
      },
      "impact_statement": "CVE-2022-25275 (SA-CORE-2022-012) is NOT present in the target. The security fix was committed to Drupal core on July 20, 2022, and Drupal 10.6.17 was released on September 16, 2026\u2014over 4 years later. The upstream release already includes the fix. Code inspection confirms all three fix components are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` to enforce access control on all non-public schemes (not just 'private'), (2) PublicStream.php has `getLocalPath()` override preventing access to files in private directories, and (3) system.module implements `system_file_download()` hook granting access to additional public schemes. The vulnerable pattern (checking only `$scheme == 'private'`) is absent; the fixed pattern (checking `!$is_public`) is present. This is an upstream vendor fix that shipped with the Drupal 10.6.17 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T01:57:26.789422+00:00",
      "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 is not present in drupal/core 10.6.17-p1+tuxcare. The vulnerability concerned missing domain validation in the Media oEmbed iframe controller's render() method. The fix (domain validation logic at lines 126-134 of OEmbedIframeController.php) was already included in the upstream Drupal 10.6.17 release, which this TuxCare branch was initialized from via snapshot commit 88bf9d33ba. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25276"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-25276 is not present in drupal/core 10.6.17-p1+tuxcare. The vulnerability concerned missing domain validation in the Media oEmbed iframe controller's render() method. The fix (domain validation logic at lines 126-134 of OEmbedIframeController.php) was already included in the upstream Drupal 10.6.17 release, which this TuxCare branch was initialized from via snapshot commit 88bf9d33ba. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2022-25277 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target Drupal 10.6.17-p1+tuxcare is not affected by CVE-2022-25277. The upstream Drupal 10.6.17 release already contained the SA-CORE-2022-014 fix (commit 96211434c6) before TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS, and (2) special handling for dot files whose basename (after dot removal) matches an insecure extension. The vulnerable pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25277"
      },
      "impact_statement": "The target Drupal 10.6.17-p1+tuxcare is not affected by CVE-2022-25277. The upstream Drupal 10.6.17 release already contained the SA-CORE-2022-014 fix (commit 96211434c6) before TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS, and (2) special handling for dot files whose basename (after dot removal) matches an insecure extension. The vulnerable pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 is not present in Drupal 10.6.17. The vulnerability involved improper evaluation of form element access control - the code treated AccessResultInterface objects as truthy boolean values instead of calling isAllowed(). The upstream fix was already included in Drupal 10.6.17 when TuxCare onboarded this version. The target code at lib/Drupal/Core/Form/FormBuilder.php:1228 correctly ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25278"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-25278 is not present in Drupal 10.6.17. The vulnerability involved improper evaluation of form element access control - the code treated AccessResultInterface objects as truthy boolean values instead of calling isAllowed(). The upstream fix was already included in Drupal 10.6.17 when TuxCare onboarded this version. The target code at lib/Drupal/Core/Form/FormBuilder.php:1228 correctly ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2023-5256 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2023-5256 is not present in Drupal 10.6.17. The vulnerability (CVE-2023-5256 / SA-CORE-2023-006) affected Drupal versions >=8.7.0 <9.5.11, >=10.0 <10.0.11, and >=10.1 <10.1.4. The fix was included in upstream Drupal 10.1.4, and the target version 10.6.17 already contains the fix from the upstream release. The security mitigations are present in HttpExceptionNormalizer.php: (1) cache max-age set to 0 when verbose error reporting is enabled, preventing sensitive error backtraces from being cached, and (2) error backtraces only shown when both 'access site reports' permission AND verbose error reporting are enabled, preventing exposure to unauthorized users.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-5256"
      },
      "impact_statement": "CVE-2023-5256 is not present in Drupal 10.6.17. The vulnerability (CVE-2023-5256 / SA-CORE-2023-006) affected Drupal versions >=8.7.0 <9.5.11, >=10.0 <10.0.11, and >=10.1 <10.1.4. The fix was included in upstream Drupal 10.1.4, and the target version 10.6.17 already contains the fix from the upstream release. The security mitigations are present in HttpExceptionNormalizer.php: (1) cache max-age set to 0 when verbose error reporting is enabled, preventing sensitive error backtraces from being cached, and (2) error backtraces only shown when both 'access site reports' permission AND verbose error reporting are enabled, preventing exposure to unauthorized users."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 affects Drupal Core's MessageCommand class where status messages rendered via JavaScript lacked adequate sanitization, allowing XSS attacks. The target (drupal/core 10.6.17-p1+tuxcare) is NOT AFFECTED because the fix was already present in upstream Drupal 10.6.17 before TuxCare onboarded this version. The MessageCommand::render() method correctly applies Xss::filterAdmin() saniti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-12393"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-12393 affects Drupal Core's MessageCommand class where status messages rendered via JavaScript lacked adequate sanitization, allowing XSS attacks. The target (drupal/core 10.6.17-p1+tuxcare) is NOT AFFECTED because the fix was already present in upstream Drupal 10.6.17 before TuxCare onboarded this version. The MessageCommand::render() method correctly applies Xss::filterAdmin() saniti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The upstream vendor's fix (Drupal issue #3457781, commit 8830f76c72) was already included in Drupal 10.6.17, which TuxCare onboarded. The fix strips full filesystem paths from error messages by converting them to relative paths, sets up error handlers early in install.php, and ensures DrupalKernel::bootEnvi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-45440"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The upstream vendor's fix (Drupal issue #3457781, commit 8830f76c72) was already included in Drupal 10.6.17, which TuxCare onboarded. The fix strips full filesystem paths from error messages by converting them to relative paths, sets up error handlers early in install.php, and ensures DrupalKernel::bootEnvi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:15.621975+00:00",
      "status_notes": "Vulnerability CVE-2024-55634 does not affect version 10.6.17-p1+tuxcare of drupal/core. Target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55634. The vulnerability (database-collation-dependent uniqueness checking allowing case-variant duplicate email addresses) was fixed in upstream Drupal before the 10.6.17 release. TuxCare onboarded version 10.6.17 on 2026-10-03, and the snapshot already contained the upstream SA-CORE-2024-004 fix code (caseSensitive property, LIKE-based case-insensitive validation, and user.install conflict detection). The fix was authored by upstream developers (dave@longwaveconsulting.com), not TuxCare, and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55634"
      },
      "impact_statement": "Target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55634. The vulnerability (database-collation-dependent uniqueness checking allowing case-variant duplicate email addresses) was fixed in upstream Drupal before the 10.6.17 release. TuxCare onboarded version 10.6.17 on 2026-10-03, and the snapshot already contained the upstream SA-CORE-2024-004 fix code (caseSensitive property, LIKE-based case-insensitive validation, and user.install conflict detection). The fix was authored by upstream developers (dave@longwaveconsulting.com), not TuxCare, and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:57.354813+00:00",
      "status_notes": "Vulnerability CVE-2024-55636 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55636. The PHP Object Injection gadget chain vulnerability has been fixed by the upstream vendor. The critical type hint `protected CacheBackendInterface $targetCacheStorage;` is present on line 89 of StorageComparer.php, preventing attackers from injecting incompatible objects during unserialization. The CVE states affected versions are \"< 10.2.11 || >= 10.3.0 < 10.3.9\"; since 10.6.17 > 10.3.9, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 88bf9d33ba.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55636"
      },
      "impact_statement": "The target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55636. The PHP Object Injection gadget chain vulnerability has been fixed by the upstream vendor. The critical type hint `protected CacheBackendInterface $targetCacheStorage;` is present on line 89 of StorageComparer.php, preventing attackers from injecting incompatible objects during unserialization. The CVE states affected versions are \"< 10.2.11 || >= 10.3.0 < 10.3.9\"; since 10.6.17 > 10.3.9, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 88bf9d33ba."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2024-55637 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target repository (Drupal 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2024-55637. The vulnerability fix (typed property declaration on ViewExecutable::$query) was already present in upstream Drupal 10.6.17 before TuxCare onboarded the release. The property at modules/views/src/ViewExecutable.php:223 has the required type enforcement: `public ?QueryPluginBase $query = NULL;`. This prevents PHP object injection by rejecting arbitrary object types during unserialization. The fix was authored by Dave Long (dave@longwaveconsulting.com) in upstream commit 8c9e92b45a (SA-CORE-2024-007) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba on 2026-10-03.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55637"
      },
      "impact_statement": "The target repository (Drupal 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2024-55637. The vulnerability fix (typed property declaration on ViewExecutable::$query) was already present in upstream Drupal 10.6.17 before TuxCare onboarded the release. The property at modules/views/src/ViewExecutable.php:223 has the required type enforcement: `public ?QueryPluginBase $query = NULL;`. This prevents PHP object injection by rejecting arbitrary object types during unserialization. The fix was authored by Dave Long (dave@longwaveconsulting.com) in upstream commit 8c9e92b45a (SA-CORE-2024-007) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba on 2026-10-03."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:12:33.660591+00:00",
      "status_notes": "Vulnerability CVE-2024-55638 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target repository at version 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55638. All SA-CORE-2024-008 security fixes were already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The vulnerable PHP Object Injection patterns have been mitigated through: (1) runtime type validation in Select.php and Update.php __toString() methods that throw UnexpectedValueException if properties are not arrays, (2) database driver restrictions in StatementPrefetch.php before ReflectionClass instantiation, and (3) typed array property declarations in DependencySerializationTrait, Attribute, and Connection classes. The fix was authored by the upstream Drupal security team (dave@longwaveconsulting.com) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-55638"
      },
      "impact_statement": "The target repository at version 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55638. All SA-CORE-2024-008 security fixes were already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The vulnerable PHP Object Injection patterns have been mitigated through: (1) runtime type validation in Select.php and Update.php __toString() methods that throw UnexpectedValueException if properties are not arrays, (2) database driver restrictions in StatementPrefetch.php before ReflectionClass instantiation, and (3) typed array property declarations in DependencySerializationTrait, Attribute, and Connection classes. The fix was authored by the upstream Drupal security team (dave@longwaveconsulting.com) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13080 is not present in this target. The security fix for the HTTP method override vulnerability (SA-CORE-2025-005) was already included in the upstream Drupal 10.6.17 release that TuxCare onboarded. The fix adds validation in RequestSanitizer::sanitize() to reject requests that override their HTTP method from an unsafe method to a safe method, preventing CSRF bypass attacks. This prot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13080"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-13080 is not present in this target. The security fix for the HTTP method override vulnerability (SA-CORE-2025-005) was already included in the upstream Drupal 10.6.17 release that TuxCare onboarded. The fix adds validation in RequestSanitizer::sanitize() to reject requests that override their HTTP method from an unsafe method to a safe method, preventing CSRF bypass attacks. This prot..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13081. The vulnerability (unsafe Transaction object deserialization) was fixed by upstream Drupal in SA-CORE-2025-006 (November 2025) by adding a __wakeup() method that prevents Transaction objects from being unserialized. This fix was already present in the upstream Drupal 10.6.17 release (September 2026) that TuxCare subseq...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13081"
      },
      "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13081. The vulnerability (unsafe Transaction object deserialization) was fixed by upstream Drupal in SA-CORE-2025-006 (November 2025) by adding a __wakeup() method that prevents Transaction objects from being unserialized. This fix was already present in the upstream Drupal 10.6.17 release (September 2026) that TuxCare subseq..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13082. The vulnerability (content spoofing via user-controlled format strings in error messages) was already fixed in the upstream Drupal 10.6.17 release through SA-CORE-2025-007. All three affected files contain the patched code that removes user input from error messages to prevent content spoofing.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13082"
      },
      "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13082. The vulnerability (content spoofing via user-controlled format strings in error messages) was already fixed in the upstream Drupal 10.6.17 release through SA-CORE-2025-007. All three affected files contain the patched code that removes user input from error messages to prevent content spoofing."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:16:38.201074+00:00",
      "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 Target Drupal core 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2025-13083. The vulnerability fix (SA-CORE-2025-008) was already present in the upstream Drupal 10.6.17 release before TuxCare onboarding. The FileDownloadController.php contains the complete fix: proper Cache-Control header management that prevents sensitive files from being cached in browsers/proxies by explicitly setting responses ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13083"
      },
      "impact_statement": "not_affected \u2014 Target Drupal core 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2025-13083. The vulnerability fix (SA-CORE-2025-008) was already present in the upstream Drupal 10.6.17 release before TuxCare onboarding. The FileDownloadController.php contains the complete fix: proper Cache-Control header management that prevents sensitive files from being cached in browsers/proxies by explicitly setting responses ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:16:38.201074+00:00",
      "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is not affected by CVE-2025-3057 (XSS via HTTP exception messages). Both required defense mechanisms from the upstream fix are present: (1) DrupalKernel.php:782 sets Content-Type to 'text/plain' for all HttpException responses, preventing browsers from interpreting exception messages as HTML; (2) DefaultExceptionHtmlSubscriber.php:93 prevents 400 Bad Request errors fro...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-3057"
      },
      "impact_statement": "not_affected \u2014 The target Drupal 10.6.17 is not affected by CVE-2025-3057 (XSS via HTTP exception messages). Both required defense mechanisms from the upstream fix are present: (1) DrupalKernel.php:782 sets Content-Type to 'text/plain' for all HttpException responses, preventing browsers from interpreting exception messages as HTML; (2) DefaultExceptionHtmlSubscriber.php:93 prevents 400 Bad Request errors fro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31673: The target Drupal 10.6.17 is not affected. The vulnerability (missing assignment in FieldUpdateActionBase.php line 56 causing incorrect authorization checks) was fixed by upstream Drupal in February 2025 (SA-CORE-2025-002), 7 months before the 10.6.17 release in September 2026. The fix was already present in the upstream 10.6.17 release that TuxCare onboarded. The target code co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31673"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-31673: The target Drupal 10.6.17 is not affected. The vulnerability (missing assignment in FieldUpdateActionBase.php line 56 causing incorrect authorization checks) was fixed by upstream Drupal in February 2025 (SA-CORE-2025-002), 7 months before the 10.6.17 release in September 2026. The fix was already present in the upstream 10.6.17 release that TuxCare onboarded. The target code co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T21:20:32.141683+00:00",
      "status_notes": "Vulnerability CVE-2025-31674 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2025-31674 (SA-CORE-2025-003) is an object injection vulnerability in Drupal's Views DisplayPluginCollection that allowed arbitrary code execution via unvalidated destroy() method calls. The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT affected because the upstream release 10.6.17 already contained the security fix before TuxCare onboarded it. The fix (instanceof DisplayPluginInterface type check) is present at DisplayPluginCollection.php:63-65. This is an upstream fix that shipped in the original Drupal 10.6.17 release (February 2025), not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31674"
      },
      "impact_statement": "CVE-2025-31674 (SA-CORE-2025-003) is an object injection vulnerability in Drupal's Views DisplayPluginCollection that allowed arbitrary code execution via unvalidated destroy() method calls. The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT affected because the upstream release 10.6.17 already contained the security fix before TuxCare onboarded it. The fix (instanceof DisplayPluginInterface type check) is present at DisplayPluginCollection.php:63-65. This is an upstream fix that shipped in the original Drupal 10.6.17 release (February 2025), not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31675 (SA-CORE-2025-004) affects Drupal core 8.0.0-11.1.5 via XSS in link field attributes. The target repository at version 10.6.17-p1+tuxcare is NOT affected because the upstream vendor fix was already included in the Drupal 10.6.17 release that TuxCare onboarded in September 2026. The fix (AttributeXss.php sanitization + calls in LinkFormatter.php and MenuLinkContent.php) is present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31675"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-31675 (SA-CORE-2025-004) affects Drupal core 8.0.0-11.1.5 via XSS in link field attributes. The target repository at version 10.6.17-p1+tuxcare is NOT affected because the upstream vendor fix was already included in the Drupal 10.6.17 release that TuxCare onboarded in September 2026. The fix (AttributeXss.php sanitization + calls in LinkFormatter.php and MenuLinkContent.php) is present..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:19:00.117037+00:00",
      "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 10.6.17-p1+tuxcare of drupal/core.",
      "vulnerability": {
        "name": "CVE-2026-108097"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:19:00.117037+00:00",
      "status_notes": "Vulnerability CVE-2026-108514 is fixed in version 10.6.17-p1+tuxcare of drupal/core.",
      "vulnerability": {
        "name": "CVE-2026-108514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:19:00.117037+00:00",
      "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 10.6.17-p1+tuxcare of drupal/core.",
      "vulnerability": {
        "name": "CVE-2026-108515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:12:47.728703+00:00",
      "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2026-6365. The XSS vulnerability in the OpenDialogCommand class was already fixed in upstream Drupal version 10.6.7, and version 10.6.17 shipped with the fix already applied. The CVE states that versions \"from 10.6.0 before 10.6.7\" are affected, confirming that 10.6.17 is safe. When TuxCare onboarded version 10.6.17 v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6365"
      },
      "impact_statement": "not_affected \u2014 The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2026-6365. The XSS vulnerability in the OpenDialogCommand class was already fixed in upstream Drupal version 10.6.7, and version 10.6.17 shipped with the fix already applied. The CVE states that versions \"from 10.6.0 before 10.6.7\" are affected, confirming that 10.6.17 is safe. When TuxCare onboarded version 10.6.17 v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6366 affects Drupal core versions from 10.6.0 before 10.6.7. The target repository is at version 10.6.17-p1+tuxcare, which includes the upstream fix that was released in Drupal 10.6.7 on 2026-04-15. The fix adds validation during object unserialization (__wakeup in ViewExecutable.php) to prevent property injection, and type checking during rendering (__toString in Attribute.php) to pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6366"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-6366 affects Drupal core versions from 10.6.0 before 10.6.7. The target repository is at version 10.6.17-p1+tuxcare, which includes the upstream fix that was released in Drupal 10.6.7 on 2026-04-15. The fix adds validation during object unserialization (__wakeup in ViewExecutable.php) to prevent property injection, and type checking during rendering (__toString in Attribute.php) to pre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T21:16:51.996676+00:00",
      "status_notes": "Vulnerability CVE-2026-9082 does not affect version 10.6.17-p1+tuxcare of drupal/core. Target Drupal 10.6.17 is NOT AFFECTED by CVE-2026-9082. The SQL injection vulnerability was fixed upstream in Drupal 10.6.9, and the target version 10.6.17 includes this fix. The vulnerability allowed attackers to inject SQL through associative array keys used in entity query conditions. The fix (array_values() normalization) is present in all three affected files, having been imported via the upstream Drupal 10.6.17 release snapshot before any TuxCare modifications.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-9082"
      },
      "impact_statement": "Target Drupal 10.6.17 is NOT AFFECTED by CVE-2026-9082. The SQL injection vulnerability was fixed upstream in Drupal 10.6.9, and the target version 10.6.17 includes this fix. The vulnerability allowed attackers to inject SQL through associative array keys used in entity query conditions. The fix (array_values() normalization) is present in all three affected files, having been imported via the upstream Drupal 10.6.17 release snapshot before any TuxCare modifications."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:12:47.728703+00:00",
      "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by GHSA-6ccv-8fgf-cjpw. The vulnerability, which could cause denial of service through unhandled NotFoundHttpException in PathBasedBreadcrumbBuilder, was fixed upstream in SA-CORE-2024-001 (commit bd803acb29) and was already present in Drupal 10.6.17 when TuxCare onboarded it. The fix adds exception handling for NotFoundHttpException in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6ccv-8fgf-cjpw"
      },
      "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by GHSA-6ccv-8fgf-cjpw. The vulnerability, which could cause denial of service through unhandled NotFoundHttpException in PathBasedBreadcrumbBuilder, was fixed upstream in SA-CORE-2024-001 (commit bd803acb29) and was already present in Drupal 10.6.17 when TuxCare onboarded it. The fix adds exception handling for NotFoundHttpException in ..."
    }
  ]
}