- CVE-2026-55693: out-of-bounds write in tree_count_words() and sug_filltree() when walking a crafted spell-file word trie deeper than MAXWLEN; bound the descent depth (src/spellfile.c) - CVE-2026-55892: stack out-of-bounds write in dump_prefixes() on :spelldump with a crafted prefix trie exceeding MAXWLEN; bound the descent depth (src/spell.c) - CVE-2026-57455: stack out-of-bounds write in spell_soundfold_sofo() when soundfold() is given an over-length word with an active SOFO spell table; add the missing length guard to the single-byte path (src/spell.c) - CVE-2026-57456: code execution in Python omni-completion: buffer-supplied docstrings were emitted inside triple-quoted literals passed to exec(), allowing breakout; quote them with repr() (runtime/autoload/python3complete.vim, pythoncomplete.vim)