- CVE-2026-68580: reject a FramesPerPacket of INT32_MAX or more in audin_process_open() before it is stored, so a malicious server cannot overflow the per-packet size arithmetic in the audio input backends - CVE-2026-66402: return the real length of certificate ASN.1 strings and reject values that are not a host name or IP, so a certificate carrying an embedded NUL can no longer pass identity validation as a shorter, different name - CVE-2026-67300: deep-clone WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER before posting them to the async update queue, and free the clone in the message destructor; the shallow copies referenced parser-owned heap released as soon as the callback returned - CVE-2026-67289: validate the server-supplied redirection fields - addresses must parse as IPv4/IPv6, FQDN and NetBIOS name must look like a host, username and domain must not contain line breaks - so CRLF in TargetNetAddress can no longer be injected into the HTTP proxy CONNECT request