- CVE-2026-53793: widen the daemon path-confinement gate to cover a chrooted module whose path carries a "/./" inner boundary marker, and route the resolver trust root and do_mkdir_at through the same predicate - CVE-2026-53796: confine the non-daemon receiver's destination chdir, refusing a destination symlink owned by another uid while still following the operator's own - CVE-2026-70452: fail closed when a hosts-deny token cannot be resolved, so a transient DNS failure no longer admits a host the deny list names - CVE-2026-53783: inode-pin the rrsync-validated path and root the argument handed to rsync at that pinned fd, refuse dangerous options in a restricted directory, add the --drop-D option the restricted receiver needs, and keep restricted-root paths working - CVE-2026-70460: pin the receiver option directories a peer can pivot through rrsync