see, fuck you, johnsoncontrols. First, just link to the fucking advisory, it isn't hard, its literally right there. Second, why does the HEAD 404 but the GET 200? Third, Why does your HEAD response have a content-length: 103 but no actual content?
OwO whats this, new reference?
*looks inside*
Status 404
CVE: CVE-2026-27875
Reference: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://db.gcve.eu/vuln/CVE-2026-27875