Can I get more info on why these are showing up? I've never seen such a thing on F-Droid before.
I changed to the Divest-repo for Mull, and they have an updated version that has fixed these security issues.
ETA: Different signing keys though, so you can't just update it, but have to reinstall.