What's fixed
- Harden asset authorization #15196 by @duncanmcclean
- Harden impersonation action #15562 by @jasonvarga
- Tighten SVG sanitization #15583 by @jasonvarga
- Harden remote URL validation #15584 by @jasonvarga
- Tighten class based validation rules #15585 by @jasonvarga
- Harden user file paths #15593 by @jasonvarga