- CVE-2026-73072: fix heap buffer overflow in set_sofo(); reset sl_sal_first[] before the SN_SOFO counting loop, since a preceding SN_SAL section may have set its entries to -1 via set_sal_first(), making the loop under-count colliding multi-byte characters and allocate an undersized list (src/spellfile.c, upstream patch 9.2.0846) - CVE-2026-73076: fix arbitrary code execution via a crafted .VimballRecord file; refuse to extract a member named .VimballRecord, record deletions with string() instead of raw quote interpolation, and execute only whitelisted call delete() entries in vimball#RmVimball() (runtime/autoload/vimball.vim, upstream patch 9.2.0847) - CVE-2026-73078: fix Ex command injection in the netrw bookmark and history menus; add the Ex separator | to g:netrw_menu_escape, escape the :e targets with fnameescape(), and quote the netrw#MakeTgt() arguments with string() (runtime/autoload/netrw.vim, upstream patch 9.2.0840)