- CVE-2023-49288: fix use-after-free in StoreEntry::startWriting() reachable via oversized replies with collapsed_forwarding enabled - CVE-2025-59362: fix mishandling of ASN.1 encoding of long SNMP OIDs in lib/snmplib/asn1.c (asn_build_objid) - CVE-2026-33515: fix validation of packet sizes and URLs in ICP - CVE-2026-47729: fix out-of-bounds read in the FTP gateway directory listing parser that could disclose memory from unrelated transactions - CVE-2026-50012: fix heap buffer overflow in cache digest reply handling when the on-the-wire payload exceeds the advertised mask size