- CVE-2026-65183: create and validate the parent directory of a unix domain socket before binding the socket to it, with configurable required parent directory permissions and an expected parent directory owner, and factor the non-POSIX permission handling out into its own helper, so that another local user can no longer win the race between the bind and the point at which the socket permissions are applied and thereby gain access to the socket - CVE-2026-66422: resolve a security-role-ref alias only in Request.isUserInRole(), and look the Context role mapping up in RealmBase.hasRole() through the wrapper's parent Context, rather than conflating the two lookups in StandardWrapper.findSecurityReference(), so that a security-role-ref declared by a servlet is no longer honoured as a role alias when the realm authorises a request - CVE-2026-68525: recompute the security constraints, the proxy caching headers and the user data constraint after FORM authentication has restored the original request, whenever the method of that restored request differs from the method of the login submission, so that a user who is permitted to POST to a resource but not to GET it can no longer reach it with a GET by driving the request through the FORM login flow