* SECURITY UPDATE: unauthorized access to session metadata through $listSessions - debian/patches/CVE-2026-13061.patch: require the internal cluster privilege when $_internalPredicate is supplied to $listSessions - CVE-2026-13061 * SECURITY UPDATE: process memory disclosure through DBPointer BSON serialization - debian/patches/CVE-2026-13066.patch: make DBPointer state immutable and validate the JavaScript class before reading ObjectId private data - CVE-2026-13066 * SECURITY UPDATE: server crash when $exchange key-range routing receives MaxKey - debian/patches/CVE-2026-9749.patch: route MaxKey documents to the final consumer bucket instead of triggering an invariant failure - CVE-2026-9749 * SECURITY UPDATE: null-pointer dereference from strict-winding polygons in GeoJSON GeometryCollection values - debian/patches/CVE-2026-9752.patch: detect strict-winding polygons inside geometry collections before 2dsphere indexing or projection - CVE-2026-9752