- CVE-2026-60163: Reject unauthenticated XCom client messages that could execute arbitrary replicated SQL on Group Replication members - CVE-2026-60315: Validate X Plugin challenge-response payloads during authentication - CVE-2026-61094: Align applier privilege checks for client BINLOG execution - CVE-2026-60316: Quote strings correctly in the X Plugin when NO_BACKSLASH_ESCAPES is set - CVE-2026-60178: Reject donor plugin library names that fail path validation during clone plugin validation - CVE-2026-60585: Validate replication events more strictly on the receiver thread - CVE-2026-61109: Report an error when JSON schema expansion revisits a node on the current path - CVE-2026-47064: Fix a NULL pointer dereference in the optimizer - CVE-2026-60183: Restrict where the clone client writes files - CVE-2026-60332: Validate fragmented GCS messages in Group Replication - CVE-2026-60331: Validate replication metadata bounds - CVE-2026-60747: Reject oversized packed row values earlier - CVE-2026-47052: Fix a missed FIL_SHARD release that leads to a deadlock under high load - CVE-2026-60145: Fix a use-after-free of TABLE::read_set in DynamicRangeIterator - CVE-2026-47023: Check event type validity on the receiver thread - CVE-2026-60177: Check the locator index in the clone Client::set_descriptor() - CVE-2026-60182: Fix a possible NULL pointer dereference in clone0apply.cc - CVE-2026-46936: Clean up all index builders when a DDL involving multiple indexes fails - CVE-2026-60186: Check buffer bounds and item lengths when decoding Group Replication plugin messages - CVE-2026-47012: Fix an assertion failure in sql_derived.cc - CVE-2026-60184: Validate DECIMAL user variable event metadata - CVE-2026-60185: Improve directly queued event validation - CVE-2026-60187: Improve fake Rotate event handling - CVE-2026-60188: Validate GTID interval payload length - CVE-2026-60189: Fix a commit-order GTID state update race - CVE-2026-60191: Improve malformed heartbeat handling - CVE-2026-61081: Report an artificial object identity instead of a server memory address in Performance Schema - CVE-2026-60190: Fix ALTER USER with an empty password replicating incorrectly