vulnerability in libinput (DEBIAN-CVE-2026-50292). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `1.16.4-3+deb11u1` or later.
vulnerability in io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (CVE-2026-48040). Confidential information can be exposed externally. Exploitable via ``sun.misc.Unsafe``. Mitigation: upgrade to `0.0.22.Final` or later.