Created Bugs

mono embedded Brotli 1.0.9 vulnerable to CVE-2026-111497

upstream security

ftp.debian.org RM: trayer -- RoQA; unmaintained, depends on gtk2

ftp.debian.org RM: libhdate -- RoQA: unused library

ftp.debian.org RM: easychem -- RoQA: unmaintained, uses gtk2

src:chemtool chemtool: Remove from Debian?

src:gnome-paint gnome-paint: Remove from Debian?

ftp.debian.org RM: python-cogent-doc -- ROM; Building the documentation is currently not possible; Quarto is not in Debian.

src:sslh sslh: echosrv heap overflow in start_listen_sockets() makes tests segfault on armhf

upstream patch

src:ntpsec ntpsec: CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486

upstream security

src:nodejs nodejs: CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106072 CVE-2026-106073 CVE-2026-106074

security upstream

src:python-aiohttp python-aiohttp: CVE-2026-111063 CVE-2026-111064 CVE-2026-111065 CVE-2026-111066 CVE-2026-111748 CVE-2026-111749 CVE-2026-111750

upstream security

src:python-filelock python-filelock: CVE-2026-112906 CVE-2026-112909 CVE-2026-112911 CVE-2026-112912 CVE-2026-112914 CVE-2026-112915 CVE-2026-112934 CVE-2026-112935 CVE-2026-112937 CVE-2026-112939 CVE-2026-112940 CVE-2026-112941

upstream security

src:python-virtualenv python-virtualenv: CVE-2026-113713 CVE-2026-113714 CVE-2026-113715 CVE-2026-113716 CVE-2026-113717 CVE-2026-113718 CVE-2026-113719 CVE-2026-113720 CVE-2026-113721 CVE-2026-113722 CVE-2026-113723 CVE-2026-113724 CVE-2026-113725 CVE-2026-113726 CVE-2026-113732 CVE-2026-113776

upstream security

nodejs TypeScript not recognized

release.debian.org nmu: libimager-qrcode-perl_0.035+dfsg-2+b1

nvidia-kernel-support please ship NVIDIA's runtime D3 (RTD3) udev rule so the dGPU can power off when idle

src:openjfx openjfx: CVE-2026-91385 CVE-2026-91402

security