- CVE-2026-2004: intarray: _int_matchsel() verifies that its input is a query_int, and only superusers may attach a non-built-in selectivity estimator to an operator (arbitrary code execution) - CVE-2026-2005: pgcrypto: reject PGP messages whose session key is longer than PGP_MAX_KEY (heap buffer overflow) - CVE-2026-2003: reject oidvector and int2vector values that are not one-dimensional or contain nulls (server memory disclosure, crash) - CVE-2026-18024: ascii(): check the remaining length and the byte values of a multibyte character (buffer over-read) - CVE-2026-14678: pg_trgm: GiST picksplit no longer reads a cached signature as a trigram array (buffer over-read)