LTS depends on CVEs. And we see here that the CVE database is not entirely trust worthy. The chain is a bit broken.