CVEs published January 1, 2026

The ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines.

A security flaw has been discovered in itsourcecode School Management System 1.0.

A malicious package could include files that are not tracked by `eopkg`.

A malicious package could escape the directory set by `--destdir`.