- CVE-2026-14668: make scalarineqsel() verify that a constant it expects to be of type tid actually is - CVE-2026-14679: enforce the aggregate argument limit and protect fixed-size FUNC_MAX_ARGS arrays - CVE-2026-6464: teach psql to skip in-line data after a COPY ... FROM STDIN that fails before PGRES_COPY_IN, so the data is no longer executed as SQL; such in-line data must now always be terminated by \. - CVE-2026-2006: make the multibyte-to-wchar conversion of every encoding drop an incomplete trailing character, as UTF-8 already did (completes the vendor fix for CVE-2026-2006) - pgoutput: report an error instead of crashing the walsender when the proto_version or publication_names option has no value (hardening, no CVE)