Candidates for DTSAs

The table below lists packages which are fixed in unstable, but unfixed in testing. Use the testing migration checker to find out why they have not entered testing yet.

List of vulnerable packages in testing

Package	Migration	Bug	Urgency	Remote
cosign	check	CVE-2026-22703	not yet assigned	no
django-allauth	check	CVE-2025-65430	not yet assigned	no
		CVE-2025-65431	not yet assigned	no
		CVE-2026-27982	not yet assigned	no
edk2	check	CVE-2024-38798	not yet assigned	no
ffmpeg	check	CVE-2025-69693	not yet assigned	no
flask	check	CVE-2026-27205	not yet assigned	no
fuse3	check	CVE-2026-33150	not yet assigned	no
		CVE-2026-33179	not yet assigned	no
glance	check	TEMP-1131274-5F0822	not yet assigned	?
golang-github-jackc-pgproto3	check	CVE-2026-4427	not yet assigned	no
golang-github-sigstore-fulcio	check	CVE-2025-66506	not yet assigned	no
		CVE-2026-22772	not yet assigned	no
grub2	check	CVE-2025-54770	not yet assigned	no
		CVE-2025-54771	not yet assigned	no
		CVE-2025-61661	not yet assigned	no
		CVE-2025-61662	not yet assigned	no
		CVE-2025-61663	not yet assigned	no
		CVE-2025-61664	not yet assigned	no
imagemagick	check	CVE-2026-28493	not yet assigned	no
		CVE-2026-28494	not yet assigned	no
		CVE-2026-28686	not yet assigned	no
		CVE-2026-28687	not yet assigned	no
		CVE-2026-28688	not yet assigned	no
		CVE-2026-28689	not yet assigned	no
		CVE-2026-28690	not yet assigned	no
		CVE-2026-28691	not yet assigned	no
		CVE-2026-28692	not yet assigned	no
		CVE-2026-28693	not yet assigned	no
		CVE-2026-30883	not yet assigned	no
		CVE-2026-30929	not yet assigned	no
		CVE-2026-30931	not yet assigned	no
		CVE-2026-30935	not yet assigned	no
		CVE-2026-30936	not yet assigned	no
		CVE-2026-30937	not yet assigned	no
		CVE-2026-31853	not yet assigned	no
		CVE-2026-32259	not yet assigned	no
incus	check	CVE-2026-28384	not yet assigned	no
jpeg-xl	check	CVE-2025-12474	not yet assigned	no
		CVE-2026-1837	not yet assigned	no
libsixel	check	CVE-2022-29977	not yet assigned	no
		CVE-2022-29978	not yet assigned	no
		CVE-2025-9300	not yet assigned	no
libssh	check	CVE-2026-0964	not yet assigned	?
		CVE-2026-0965	not yet assigned	?
		CVE-2026-0966	not yet assigned	?
		CVE-2026-0967	not yet assigned	?
		CVE-2026-0968	not yet assigned	?
		CVE-2026-3731	not yet assigned	no
libxml-parser-perl	check	CVE-2006-10003	medium	no
node-flatted	check	CVE-2026-33228	not yet assigned	no
node-socket.io-parser	check	CVE-2026-33151	not yet assigned	no
openexr	check	CVE-2025-12495	not yet assigned	no
		CVE-2025-12839	not yet assigned	no
		CVE-2025-12840	not yet assigned	no
		CVE-2025-48074	not yet assigned	no
		CVE-2025-64181	not yet assigned	no
		CVE-2026-27622	not yet assigned	no
ormar	check	CVE-2026-27953	not yet assigned	no
pyasn1	check	CVE-2026-30922	not yet assigned	no
python-dynaconf	check	CVE-2026-33154	not yet assigned	no
qemu	check	CVE-2026-2243	not yet assigned	no
		CVE-2026-3195	not yet assigned	?
		CVE-2026-3196	not yet assigned	?
		CVE-2026-3842	not yet assigned	?
roundcube	check	TEMP-1131182-2BBEF7	not yet assigned	?
		TEMP-1131182-329769	not yet assigned	?
		TEMP-1131182-408014	not yet assigned	?
		TEMP-1131182-70C2AD	not yet assigned	?
		TEMP-1131182-79F7AC	not yet assigned	?
		TEMP-1131182-88010C	not yet assigned	?
		TEMP-1131182-B1EAD2	not yet assigned	?
		TEMP-1131182-D0A1D2	not yet assigned	?
ruby-bcrypt	check	CVE-2026-33306	not yet assigned	?
ruby-rack	check	CVE-2026-22860	not yet assigned	no
		CVE-2026-25500	not yet assigned	no
rust-wasmtime	check	CVE-2026-27204	not yet assigned	no
		CVE-2026-27572	not yet assigned	no
vim	check	CVE-2026-26269	not yet assigned	no
		CVE-2026-28417	not yet assigned	no
		CVE-2026-28418	not yet assigned	no
		CVE-2026-28419	not yet assigned	no
		CVE-2026-28420	not yet assigned	no
		CVE-2026-28421	not yet assigned	no
		CVE-2026-33412	not yet assigned	?
webkit2gtk	check	CVE-2025-46299	not yet assigned	no
wordpress	check	CVE-2026-3906	not yet assigned	no
wpewebkit	check	CVE-2025-46299	not yet assigned	no