- CVE-2026-53784: resolve an absolute daemon path one component at a time with an O_NOFOLLOW dirfd per level so a planted symlink cannot steer the daemon CWD outside the module when "use chroot = no" - CVE-2026-53791: require the direct peer to match the new "proxy protocol hosts" list before a PROXY protocol header is trusted, so a forged source address cannot bypass "hosts allow" and "hosts deny" - CVE-2026-53803: route the log file, batch files, motd, early-input file, daemon lock file and rsyncd.conf through open_no_attacker_symlinks() so a planted symlink cannot redirect an ancillary open - CVE-2026-70463: parse "auth users" with conf_strtok() so a comma-only entry containing a space keeps its deny rule instead of being split on whitespace and silently discarded