* SECURITY UPDATE: X Plugin accepts malformed challenge-response payloads - debian/patches/CVE-2026-60315.patch: require the client scramble and stored hash to have the expected length and format before get_salt_from_password() parses them, in plugin/x/src/native_verification.cc and plugin/x/src/cache_based_verification.cc. - CVE-2026-60315 * SECURITY UPDATE: server hang on a cyclic JSON schema reference - debian/patches/CVE-2026-61109.patch: reject cyclic $ref chains when validating a JSON schema, in sql/json_schema.cc. - CVE-2026-61109 * SECURITY UPDATE: use-after-free of TABLE::read_set in DynamicRangeIterator - debian/patches/CVE-2026-47064.patch: restore the saved read_set through a Scope_guard on every exit path of IndexSkipScanIterator::Init() and Read(), in sql/range_optimizer/index_skip_scan.cc. - CVE-2026-47064 * SECURITY UPDATE: optimizer crash (SEGV) in subquery_to_derived - debian/patches/CVE-2026-60145.patch: reference-count the Item_field copy made in Query_block::replace_item_in_expression(), so it cannot be freed while another occurrence still refers to it, in sql/sql_resolver.cc. - CVE-2026-60145 * SECURITY UPDATE: null pointer dereference in the clone apply path - debian/patches/CVE-2026-60177.patch: validate the data file index before dereferencing it, in storage/innobase/clone/clone0apply.cc. - CVE-2026-60177 * SECURITY UPDATE: failed DDL leaves index builders uncleaned - debian/patches/CVE-2026-46936.patch: release all builders when a DDL operation fails, in storage/innobase/ddl/ddl0builder.cc. - CVE-2026-46936 * SECURITY UPDATE: clone client can be directed to write to an arbitrary path - debian/patches/CVE-2026-60178.patch: validate the donor-supplied file path before the clone client writes it, in storage/innobase/clone/clone0apply.cc. - CVE-2026-60178 * SECURITY UPDATE: clone client crash from an unchecked descriptor index - debian/patches/CVE-2026-60182.patch: bound-check loc_index in Client::set_descriptor() before use, in plugin/clone/src/clone_client.cc. - CVE-2026-60182 * SECURITY UPDATE: performance schema exposes raw object instance addresses - debian/patches/CVE-2026-61081.patch: derive OBJECT_INSTANCE_BEGIN columns instead of exposing raw pointers, in storage/perfschema/. - CVE-2026-61081 * SECURITY UPDATE: InnoDB deadlock from a missed FIL_SHARD release - debian/patches/CVE-2026-47052.patch: release the fil shard on the error path so concurrent tablespace lookups cannot deadlock under load, in storage/innobase/fil/fil0fil.cc. - CVE-2026-47052 * SECURITY UPDATE: donor-controlled dlopen() path traversal during clone plugin validation - debian/patches/CVE-2026-60183.patch: validate donor-supplied shared object names before dlopen(), in plugin/clone/src/clone_client.cc. - CVE-2026-60183 * SECURITY UPDATE: X Plugin SQL injection with NO_BACKSLASH_ESCAPES - debian/patches/CVE-2026-60316.patch: escape string literals according to the session's NO_BACKSLASH_ESCAPES mode when building SQL in the X Plugin, via the new plugin/x/src/helper/sql_literal_escaping.h and query_formatter.cc. - CVE-2026-60316 * SECURITY UPDATE: server crash from a failed CHECK TABLE on a lost connection - debian/patches/CVE-2026-47012.patch: handle the network error path during CHECK TABLE without dereferencing the released table, in sql/sql_admin.cc. - CVE-2026-47012