From 2bd3343c2dc707ac24d571078642aab8269fded5 Mon Sep 17 00:00:00 2001
From: Noah Stapp <noah.stapp@mongodb.com>
Date: Thu, 24 Sep 2026 14:58:09 -0400
Subject: [PATCH] Update changelog to include CVEs

---
 doc/changelog.rst | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/doc/changelog.rst b/doc/changelog.rst
index ad82e97516..2a044aaccd 100644
--- a/doc/changelog.rst
+++ b/doc/changelog.rst
@@ -6,10 +6,13 @@ Changes in Version 4.18.2 (2026/09/24)
 
 Version 4.18.2 is a bug fix release.
 
-- Hardened the bson buffer size guard against signed integer overflow.
-- Fixed connection string parsing to percent-decode each host individually.
-- Client-side field level encryption now rejects a KMS endpoint ending in
-  ``.sock``.
+- Hardened the bson buffer size guard against signed integer overflow. (`CVE-2026-96749`_).
+- Fixed connection string parsing to percent-decode each host individually. (`CVE-2026-96748`_).
+- Client-side field level encryption now rejects a KMS endpoint ending in ``.sock``. (`CVE-2026-96747`_).
+
+.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749
+.. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748
+.. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747
 
 Issues Resolved
 ...............