The table below lists packages which are fixed in unstable, but unfixed in testing. Use the testing migration checker to find out why they have not entered testing yet.
| Package | Migration | Bug | Urgency | Remote | |
|---|---|---|---|---|---|
| aardvark-dns | check | CVE-2026-35406 | not yet assigned | no | |
| botan3 | check | CVE-2026-32877 | not yet assigned | no | |
| CVE-2026-32883 | not yet assigned | no | |||
| CVE-2026-32884 | not yet assigned | no | |||
| CVE-2026-34582 | not yet assigned | no | |||
| chromium | check | CVE-2026-5858 | not yet assigned | no | (fixed in stable?) |
| CVE-2026-5859 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5860 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5861 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5862 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5863 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5864 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5865 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5866 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5867 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5868 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5869 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5870 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5871 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5872 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5873 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5874 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5875 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5876 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5877 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5878 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5879 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5880 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5881 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5882 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5883 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5884 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5885 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5886 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5887 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5888 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5889 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5890 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5891 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5892 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5893 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5894 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5895 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5896 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5897 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5898 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5899 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5900 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5901 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5902 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5903 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5904 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5905 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5906 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5907 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5908 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5909 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5910 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5911 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5912 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5913 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5914 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5915 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5918 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5919 | not yet assigned | no | (fixed in stable?) | ||
| cockpit | check | CVE-2026-4631 | not yet assigned | no | |
| dovecot | check | CVE-2025-59028 | not yet assigned | no | |
| CVE-2025-59032 | not yet assigned | no | |||
| CVE-2026-24031 | not yet assigned | no | |||
| CVE-2026-27855 | not yet assigned | no | |||
| CVE-2026-27856 | not yet assigned | no | |||
| CVE-2026-27857 | not yet assigned | no | |||
| CVE-2026-27858 | not yet assigned | no | |||
| CVE-2026-27859 | not yet assigned | no | |||
| CVE-2026-27860 | not yet assigned | no | |||
| edk2 | check | CVE-2024-38798 | not yet assigned | no | |
| erlang | check | CVE-2026-28808 | not yet assigned | no | |
| CVE-2026-28810 | not yet assigned | no | |||
| CVE-2026-32144 | not yet assigned | no | |||
| firefox-esr | check | CVE-2026-5731 | not yet assigned | no | (fixed in stable?) |
| CVE-2026-5732 | not yet assigned | no | (fixed in stable?) | ||
| CVE-2026-5734 | not yet assigned | no | (fixed in stable?) | ||
| firewalld | check | CVE-2026-4948 | not yet assigned | no | |
| flask | check | CVE-2026-27205 | not yet assigned | no | |
| flatpak | check | CVE-2026-34078 | not yet assigned | no | |
| CVE-2026-34079 | not yet assigned | no | |||
| TEMP-1132945-4CEFB2 | not yet assigned | ? | |||
| TEMP-1132946-5EDD2C | not yet assigned | ? | |||
| flatpak-builder | check | CVE-2026-39977 | not yet assigned | no | |
| golang-google-grpc | check | CVE-2026-33186 | not yet assigned | no | |
| grub2 | check | CVE-2025-54770 | not yet assigned | no | |
| CVE-2025-54771 | not yet assigned | no | |||
| CVE-2025-61661 | not yet assigned | no | |||
| CVE-2025-61662 | not yet assigned | no | |||
| CVE-2025-61663 | not yet assigned | no | |||
| CVE-2025-61664 | not yet assigned | no | |||
| kamailio | check | CVE-2026-39863 | not yet assigned | no | |
| keystone | check | CVE-2026-33551 | not yet assigned | no | |
| ldap-account-manager | check | CVE-2025-58174 | not yet assigned | no | |
| CVE-2026-27894 | not yet assigned | no | |||
| CVE-2026-27895 | not yet assigned | no | |||
| lexbor | check | CVE-2026-29078 | not yet assigned | no | |
| CVE-2026-29079 | not yet assigned | no | |||
| linux | check | CVE-2026-23401 | not yet assigned | no | |
| CVE-2026-23402 | not yet assigned | no | |||
| CVE-2026-23414 | not yet assigned | no | |||
| CVE-2026-23415 | not yet assigned | no | |||
| CVE-2026-23416 | not yet assigned | no | |||
| CVE-2026-23417 | not yet assigned | no | |||
| CVE-2026-31406 | not yet assigned | no | |||
| CVE-2026-31408 | not yet assigned | no | |||
| mediawiki | check | CVE-2026-34095 | not yet assigned | ? | |
| mxml | check | CVE-2026-5037 | not yet assigned | no | |
| node-minimatch | check | CVE-2026-26996 | not yet assigned | no | |
| CVE-2026-27903 | not yet assigned | no | |||
| CVE-2026-27904 | not yet assigned | no | |||
| openimageio | check | CVE-2024-55192 | not yet assigned | no | |
| psd-tools | check | CVE-2026-27809 | not yet assigned | no | |
| python-cryptography | check | CVE-2026-39892 | not yet assigned | no | |
| python3.14 | check | CVE-2025-13462 | not yet assigned | no | |
| CVE-2026-2297 | not yet assigned | no | |||
| CVE-2026-3644 | not yet assigned | no | |||
| CVE-2026-4224 | not yet assigned | no | |||
| CVE-2026-4519 | not yet assigned | no | |||
| ruby-rack | check | CVE-2026-26961 | not yet assigned | no | |
| CVE-2026-26962 | not yet assigned | no | |||
| CVE-2026-32762 | not yet assigned | no | |||
| CVE-2026-34230 | not yet assigned | no | |||
| CVE-2026-34763 | not yet assigned | no | |||
| CVE-2026-34785 | not yet assigned | no | |||
| CVE-2026-34786 | not yet assigned | no | |||
| CVE-2026-34826 | not yet assigned | no | |||
| CVE-2026-34827 | not yet assigned | no | |||
| CVE-2026-34829 | not yet assigned | no | |||
| CVE-2026-34830 | not yet assigned | no | |||
| CVE-2026-34831 | not yet assigned | no | |||
| CVE-2026-34835 | not yet assigned | no | |||
| rust-rustls-webpki | check | TEMP-1133085-EC036F | not yet assigned | ? | |
| util-linux | check | CVE-2026-27456 | not yet assigned | no | |
| vega.js | check | CVE-2025-26619 | not yet assigned | no | |
| CVE-2025-27793 | not yet assigned | no | |||
| CVE-2025-59840 | not yet assigned | no | |||
| CVE-2025-65110 | not yet assigned | no | |||
| CVE-2025-66648 | not yet assigned | no | |||
| vim | check | CVE-2026-34714 | not yet assigned | no | |
| CVE-2026-34982 | not yet assigned | no | |||
| CVE-2026-35177 | not yet assigned | no | |||
| webkit2gtk | check | CVE-2025-46299 | not yet assigned | no | |
| CVE-2026-20643 | not yet assigned | no | |||
| CVE-2026-20664 | not yet assigned | no | |||
| CVE-2026-20665 | not yet assigned | no | |||
| CVE-2026-20691 | not yet assigned | no | |||
| CVE-2026-28857 | not yet assigned | no | |||
| CVE-2026-28859 | not yet assigned | no | |||
| CVE-2026-28861 | not yet assigned | no | |||
| CVE-2026-28871 | not yet assigned | no | |||
| xdg-dbus-proxy | check | CVE-2026-34080 | not yet assigned | no | |
| xdg-desktop-portal | check | TEMP-1132958-8B58DF | not yet assigned | ? | |
| zlib | check | CVE-2026-27171 | not yet assigned | no |