- CVE-2023-2455: mark the plan of an inlined set-returning function as dependent on the role when the function's query uses row-level security (wrong policies applied) - CVE-2024-10976: mark cached plans as dependent on the role when a subquery, CTE or sublink references a table with row-level security (wrong policies applied) - CVE-2024-10978: SET ROLE and SET SESSION AUTHORIZATION no longer reset each other on transaction rollback or function exit (queries run as the wrong user ID) - CVE-2026-14666: invalidate role-dependent cached plans after changes to role membership, role attributes or database ownership (stale row-level security policies)