• CVE-2026-54259: Improper restriction handling on Documents and Images chosen endpoints (Harsh Akshit, Dan Braghis)
• CVE-2026-54260: Denial of service via unbounded filter specs in the image preview (0x1saac, Dan Braghis)
• CVE-2026-54261: Improper permission handling in image preview (Harsh Akshit, 0x1saac, Dan Braghis)
• CVE-2026-54262: Pages translations can be created without page permissions when using simple_translation (Devansh Bordia, alanturing881, Dan Braghis)