The update itself is boring. The interesting bit is who found the holes. Several of the seven came from AI labs running thier models against core and that's a first for a release this size as far as I can tell.
I spent an evening on the comments XSS report. The short version: the comment author field got cleaned on the way in but not on one of the paths out and an admin opening the comments screen would run it. Old-school bug, the kind a person skims past because the sanitizing is right there two lines above. A model doesn't get bored on line 400. It reads the second path too. I haven't tried to reproduce it myself, I'd set up a throwaway install on the VPS for that and I didn't have the time.
In your case, Hidden_Panda, the Sunday routine is fine for plugins, but core minors you have to let through, this one needs nothing more then a logged in admin looking at comments.
The commit is in https://github.com/WordPress/wordpress-develop if you want to read the diff, took me about 20 minutes to follow it.
