- CVE-2026-53784: confine the daemon's absolute chdir target with a new ownership-walk resolver so a planted parent symlink cannot steer a "use chroot = no" module root outside the module - CVE-2026-53786: strip a real module_dir prefix before the daemon-filter check on a merge-file path -- leaving the daemon's own "include from" / "exclude from" paths alone -- and treat a hidden merge file as non-existent - CVE-2026-53803: open the batch stream and replay script, motd, lock, log and config files through the ownership-walk resolver, and refuse a non-regular --read-batch file - CVE-2026-53789: clean a requested path's trailing slash and keep an implied-parent directory non-content, blocking --delete widening - CVE-2026-70459: reject a non-directory transfer-root entry