Added release note stubs for 1.5.9 and 1.4.14.
Prevented reverse() from generating URLs pointing to other hosts.

This is a security fix. Disclosure following shortly.
Fixed #23157 -- Removed O(n) algorithm when uploading duplicate file names.

This is a security fix. Disclosure following shortly.
Fixed #23066 -- Modified RemoteUserMiddleware to logout on REMOTE_USER change.

This is a security fix. Disclosure following shortly.
Prevented data leakage in contrib.admin via query string manipulation.

This is a security fix. Disclosure following shortly.