- CVE-2026-14678: fix out-of-bounds read in pg_trgm's GiST picksplit function with all-true signatures - CVE-2026-6470: require USAGE privilege on the subtype in CREATE TYPE AS RANGE, on the composite type in ALTER TABLE OF, and on the types used by stored expressions (defaults, constraints, indexes, policies, rules, triggers, partition keys, domains and function parameter defaults) - CVE-2026-18024: fix out-of-bounds read in ascii() on invalid or truncated multibyte characters - CVE-2026-14666: invalidate cached plans that depend on row-level security after role membership or role attribute changes - CVE-2026-14663: make pgcrypto's PGP encryption fail when the cipher cannot be initialized instead of emitting the plaintext; add the ignore-cipher-failure decryption option to recover such messages