diff --git a/doc/src/sgml/release-15.sgml b/doc/src/sgml/release-15.sgml
index e4ed529d4aa..f6ba25cbabf 100644
--- a/doc/src/sgml/release-15.sgml
+++ b/doc/src/sgml/release-15.sgml
@@ -354,35 +354,6 @@ Branch: REL_14_STABLE [42d333a78] 2026-08-10 06:38:36 -0700
-
- Fix multirange type handling
- in pg_restore_attribute_stats()
- (OpenAI Security Research Team)
-
-
-
- pg_restore_attribute_stats() treated multirange
- types just like their underlying range type. This works correctly
- for the bounds histogram, but it was wrong for all the other
- statistics kinds.
-
-
-
- The PostgreSQL Project thanks
- Amy Burnett (OpenAI Codex Security)
- for reporting this problem.
- (CVE-2026-16238)
-
-
-
-
-
-
- Reject GSSEncRequest after direct SSL connection (Michael Paquier)
-
-
-
- After establishing a TLS-encrypted connection, the server would
- still accept a request for GSSAPI encryption. If that succeeded,
- the connection would proceed using TLS encryption, but it would look
- like a GSS connection to the pg_hba rules.
- Thus, a pg_hba policy intending to disallow TLS
- would not be enforced correctly.
-
-
-
- The PostgreSQL Project thanks
- p4p3r
- for reporting this problem.
- (CVE-2026-14681)
-
-
-
-
-
-
- Make mock SCRAM authentication secrets more plausible (Nathan Bossart)
-
-
-
- If a SCRAM login is attempted against a role that doesn't exist or
- doesn't have a SCRAM secret, we generate a mock secret and carry out
- the authentication handshake anyway, to avoid revealing these facts
- to an attacker. But the mock secret was made with a fixed iteration
- count, which in itself can be an observable response discrepancy.
- Use the configuration setting scram_iterations
- instead, to make the mock secret look more like the installation's
- real secrets.
-
-
-
- The PostgreSQL Project thanks
- Radim Marek
- for reporting this problem.
- (CVE-2026-14672)
-
-
-
-
-
-
- Fix buffer overrun
- in contrib/pg_stat_statements (Álvaro Herrera)
-
-
-
- Query normalization didn't accurately account for the amount of
- space the normalized string would require.
-
-
-
- The PostgreSQL Project thanks
- Sajeeb Lohani (with TrendAI Zero Day Initiative) and Yuelin Wang
- for reporting this problem.
- (CVE-2026-14676)
-
-
-
-
-