I can get the CVEs. I can also backport the patches into stable along with the previous set.
Curiously, there were 6 patchsets and 6 security bugs. But not all of them match up. For example, two patchsets fix one bug and another patchset fixes a directory traversal which isn't mentioned at all. I'll be using this [1] to fix stable or its version equivalent. - Craig 1: https://github.com/WordPress/WordPress/commit/2fc33ef47d3a4d48f03ef79d4aacf420da51bb54
