- CVE-2026-14673: amcheck: run index expressions with an empty search_path so an amcheck grantee cannot execute functions as the index owner - CVE-2026-19385: pg_dump: stop assuming the length of pg_proc.protrftypes, fixing a heap buffer overflow when dumping functions with long transform lists - CVE-2024-0985: run REFRESH MATERIALIZED VIEW CONCURRENTLY in the right security context - CVE-2026-2004: intarray: harden _int_matchsel() against being attached to the wrong operator, and require superuser to install a non-built-in selectivity estimator - CVE-2026-2005: pgcrypto: fix buffer overflow in pgp_pub_decrypt_bytea() - CVE-2026-2006: replace pg_mblen() with bounds-checked versions and require PGP-decrypted text to pass encoding validation - CVE-2026-6471: add the output_plugin_libraries setting so that only trusted logical decoding output plugins can be loaded - CVE-2026-14664: fix a potential buffer overrun in the regexp match/split functions - CVE-2026-14662: harden tsquery and tsvector code against overflows