diff --git a/ChangeLog.d/chacha20-counter-overflow.txt b/ChangeLog.d/chacha20-counter-overflow.txt
index 0d824d6a9c..dfdac507df 100644
--- a/ChangeLog.d/chacha20-counter-overflow.txt
+++ b/ChangeLog.d/chacha20-counter-overflow.txt
@@ -1,4 +1,4 @@
 Security
    * Reject ChaCha20 operations that would make the 32-bit block counter wrap
      around, which could otherwise reuse keystream and compromise
-     confidentiality. CVE-2026-50584
+     confidentiality. Reported by jiliang. CVE-2026-50584
diff --git a/ChangeLog.d/ecp-modp-side-channel.txt b/ChangeLog.d/ecp-modp-side-channel.txt
index 83645e5741..591abd8203 100644
--- a/ChangeLog.d/ecp-modp-side-channel.txt
+++ b/ChangeLog.d/ecp-modp-side-channel.txt
@@ -2,4 +2,5 @@ Security
    * Fix a side channel in ECC computations that allows a powerful local
      attacker (typically, untrusted OS attacking a secure enclave) to fully
      recover long-term secret keys. Found and reported by Alejandro Cabrera
-     Aldaya from Tampere University.
+     Aldaya from Tampere University. CVE-2026-54435
+
diff --git a/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt b/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt
index 44906298da..56020af2f7 100644
--- a/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt
+++ b/ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt
@@ -1,3 +1,4 @@
 Security
    * Fix a 1-byte buffer overread when parsing a malformed ECC public key
-     in the PK module.
+     in the PK module. CVE-2026-50583
+
diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt
index c7d3ca0782..c9e285b80e 100644
--- a/ChangeLog.d/security-issue1569.txt
+++ b/ChangeLog.d/security-issue1569.txt
@@ -1,4 +1,7 @@
 Security
    * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that
      this function only sets signature algorithms that are enforced during
-     TLS key exchange and not on certificate verification.
+     TLS key exchange and not on certificate verification. Reported by
+     Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT).
+     CVE-2026-54441
+
diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt
index 20d7a18fbd..4c338480f6 100644
--- a/ChangeLog.d/tls13-hrr-selected-group.txt
+++ b/ChangeLog.d/tls13-hrr-selected-group.txt
@@ -1,5 +1,7 @@
 Security
    * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was
-     not advertised in the original ClientHello. Reported by
+     not advertised in the original ClientHello. Reported independently by
      Din Asotić / Xiangdong Li, Beijing University of Posts and
-     Telecommunications (BUPT)
+     Telecommunications (BUPT), and NVIDIA Project Vanessa.
+     CVE-2026-25832.
+