- CVE-2026-55693: bound the trie-descent depth counter against the MAXWLEN-element stack arrays in tree_count_words() to prevent an out-of-bounds write when reading a crafted spell file (src/spellfile.c, upstream vim 9.2.0653) - CVE-2026-55892: bound the trie-descent depth counter in dump_prefixes() to prevent a stack out-of-bounds write with a crafted .spl spell file (src/spell.c, upstream vim 9.2.0662) - CVE-2026-57455: bound the single-byte SOFO result copy in spell_soundfold_sofo() to MAXWLEN-1 to prevent a stack out-of-bounds write when sound-folding long words (src/spell.c, upstream vim 9.2.0698) - CVE-2026-57456: use repr() on reconstructed docstrings in the python3 omni-completion so a hostile buffer cannot break out of the triple-quoted literal and execute arbitrary Python during completion (runtime/autoload/python3complete.vim, upstream vim 9.2.0699)