diff --git a/security/vuxml/files/tidy.xsl b/security/vuxml/files/tidy.xsl
index c890e51e0d72..6f746cb5fec0 100644
--- a/security/vuxml/files/tidy.xsl
+++ b/security/vuxml/files/tidy.xsl
@@ -1,136 +1,137 @@
 <?xml version="1.0"?>
 <xsl:stylesheet version="1.0"
 	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 	xmlns:vuxml="http://www.vuxml.org/apps/vuxml-1"
 	xmlns:xhtml="http://www.w3.org/1999/xhtml"
 	exclude-result-prefixes="vuxml xhtml"
 	>
 
 <xsl:param name="upper" select="'ABCDEF'" />
 <xsl:param name="lower" select="'abcdef'" />
 
 <xsl:output
   method="xml"
   encoding="utf-8"
   omit-xml-declaration="yes"
   indent="yes"
   />
 
 <!--
 All this special care is needed so that we can control the
 output of namespace declarations.  Using copy/copy-of may
 result in more namespace declarations than we wish.
 -->
 
 <xsl:template match="/">
 	<xsl:text disable-output-escaping="yes"><![CDATA[<?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd" [
 <!ENTITY vuln-2003 SYSTEM "vuln/2003.xml">
 <!ENTITY vuln-2004 SYSTEM "vuln/2004.xml">
 <!ENTITY vuln-2005 SYSTEM "vuln/2005.xml">
 <!ENTITY vuln-2006 SYSTEM "vuln/2006.xml">
 <!ENTITY vuln-2007 SYSTEM "vuln/2007.xml">
 <!ENTITY vuln-2008 SYSTEM "vuln/2008.xml">
 <!ENTITY vuln-2009 SYSTEM "vuln/2009.xml">
 <!ENTITY vuln-2010 SYSTEM "vuln/2010.xml">
 <!ENTITY vuln-2011 SYSTEM "vuln/2011.xml">
 <!ENTITY vuln-2012 SYSTEM "vuln/2012.xml">
 <!ENTITY vuln-2013 SYSTEM "vuln/2013.xml">
 <!ENTITY vuln-2014 SYSTEM "vuln/2014.xml">
 <!ENTITY vuln-2015 SYSTEM "vuln/2015.xml">
 <!ENTITY vuln-2016 SYSTEM "vuln/2016.xml">
 <!ENTITY vuln-2017 SYSTEM "vuln/2017.xml">
 <!ENTITY vuln-2018 SYSTEM "vuln/2018.xml">
 <!ENTITY vuln-2019 SYSTEM "vuln/2019.xml">
 <!ENTITY vuln-2020 SYSTEM "vuln/2020.xml">
 <!ENTITY vuln-2021 SYSTEM "vuln/2021.xml">
 <!ENTITY vuln-2022 SYSTEM "vuln/2022.xml">
 <!ENTITY vuln-2023 SYSTEM "vuln/2023.xml">
 <!ENTITY vuln-2024 SYSTEM "vuln/2024.xml">
 <!ENTITY vuln-2025 SYSTEM "vuln/2025.xml">
+<!ENTITY vuln-2026 SYSTEM "vuln/2026.xml">
 ]>
 ]]></xsl:text>
   <xsl:apply-templates />
 </xsl:template>
 
 <!-- Copy processing instructions and comments, too. -->
 <xsl:template match="processing-instruction()|comment()">
   <xsl:copy>
     <xsl:apply-templates />
   </xsl:copy>
 </xsl:template>
 
 <!--
 Set the namespace on the <vuxml> element.  Sort the <vuln> elements
 in descending order of their <modified> elements (or <entry>, if they
 don't have <modified>).  Insert an empty line between <vuln> elements.
 -->
 <xsl:template match="vuxml:vuxml">
   <xsl:element name="{name()}" namespace="{namespace-uri(.)}">
     <xsl:for-each select="@*">
       <xsl:attribute name="{name()}"><xsl:value-of
 	select="." /></xsl:attribute>
     </xsl:for-each>
     <xsl:for-each select="vuxml:vuln">
       <xsl:sort
 	order="descending"
 	select="vuxml:dates/entry/text()" />
       <xsl:text disable-output-escaping="yes">&#10;&#32;&#32;</xsl:text>
       <xsl:apply-templates select="." />
       <xsl:text disable-output-escaping="yes">&#10;</xsl:text>
     </xsl:for-each>
   </xsl:element>
 <xsl:text>&#10;</xsl:text>
 </xsl:template>
 
 <!--
 Many elements have only text content.  Strip extraneous whitespace
 from those elements.
 -->
 <xsl:template match="vuxml:topic|vuxml:name|vuxml:le|vuxml:lt|
   vuxml:ge|vuxml:gt|vuxml:eq|vuxml:cvename|vuxml:url|vuxml:bid|
   vuxml:certsa|vuxml:certvu|vuxml:uscertsa|vuxml:uscertta|
   vuxml:mlist|vuxml:freebsdsa|vuxml:freebsdpr|vuxml:discovery|
   vuxml:entry|vuxml:modified">
   <xsl:call-template name="normalize-space">
     <xsl:with-param name="node" select="." />
     <xsl:with-param name="namespace" select="namespace-uri(.)" />
   </xsl:call-template>
 </xsl:template>
 
 <!-- Default copy. -->
 <xsl:template match="*">
   <xsl:element name="{name()}" namespace="{namespace-uri(.)}">
     <xsl:call-template name="copy-attr">
       <xsl:with-param name="node" select="." />
     </xsl:call-template>
     <xsl:apply-templates />
   </xsl:element>
 </xsl:template>
 
 <!-- Copy attributes, but fold VuXML IDs (vid) to lower case.  -->
 <xsl:template name="copy-attr">
   <xsl:param name="node" />
     <xsl:if test="$node/@vid">
       <xsl:attribute name="vid"><xsl:value-of
 	  select="translate(@vid,$upper,$lower)" /></xsl:attribute>
     </xsl:if>
     <xsl:for-each select="$node/@*[name() != 'vid']">
       <xsl:attribute name="{name()}"><xsl:value-of
 	select="." /></xsl:attribute>
     </xsl:for-each>
 </xsl:template>
 
 <!-- Strip whitespace from elements with only text -->
 <xsl:template name="normalize-space">
   <xsl:param name="node" />
   <xsl:param name="namespace" />
   <xsl:element name="{name($node)}" namespace="{$namespace}">
     <xsl:call-template name="copy-attr">
       <xsl:with-param name="node" select="$node" />
     </xsl:call-template>
     <xsl:value-of select="normalize-space($node/text())" />
   </xsl:element>
 </xsl:template>
 
 </xsl:stylesheet>
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index f5af9b864a2a..898ca45c2d68 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -1,110 +1,112 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd" [
 <!ENTITY vuln-2003 SYSTEM "vuln/2003.xml">
 <!ENTITY vuln-2004 SYSTEM "vuln/2004.xml">
 <!ENTITY vuln-2005 SYSTEM "vuln/2005.xml">
 <!ENTITY vuln-2006 SYSTEM "vuln/2006.xml">
 <!ENTITY vuln-2007 SYSTEM "vuln/2007.xml">
 <!ENTITY vuln-2008 SYSTEM "vuln/2008.xml">
 <!ENTITY vuln-2009 SYSTEM "vuln/2009.xml">
 <!ENTITY vuln-2010 SYSTEM "vuln/2010.xml">
 <!ENTITY vuln-2011 SYSTEM "vuln/2011.xml">
 <!ENTITY vuln-2012 SYSTEM "vuln/2012.xml">
 <!ENTITY vuln-2013 SYSTEM "vuln/2013.xml">
 <!ENTITY vuln-2014 SYSTEM "vuln/2014.xml">
 <!ENTITY vuln-2015 SYSTEM "vuln/2015.xml">
 <!ENTITY vuln-2016 SYSTEM "vuln/2016.xml">
 <!ENTITY vuln-2017 SYSTEM "vuln/2017.xml">
 <!ENTITY vuln-2018 SYSTEM "vuln/2018.xml">
 <!ENTITY vuln-2019 SYSTEM "vuln/2019.xml">
 <!ENTITY vuln-2020 SYSTEM "vuln/2020.xml">
 <!ENTITY vuln-2021 SYSTEM "vuln/2021.xml">
 <!ENTITY vuln-2022 SYSTEM "vuln/2022.xml">
 <!ENTITY vuln-2023 SYSTEM "vuln/2023.xml">
 <!ENTITY vuln-2024 SYSTEM "vuln/2024.xml">
 <!ENTITY vuln-2025 SYSTEM "vuln/2025.xml">
+<!ENTITY vuln-2026 SYSTEM "vuln/2026.xml">
 ]>
 <!--
-Copyright 2003-2025 Jacques Vidrine and contributors
+Copyright 2003-2026 Jacques Vidrine and contributors
 
 Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
 HTML, PDF, PostScript, RTF and so forth) with or without modification,
 are permitted provided that the following conditions are met:
 1. Redistributions of source code (VuXML) must retain the above
    copyright notice, this list of conditions and the following
    disclaimer as the first lines of this file unmodified.
 2. Redistributions in compiled form (transformed to other DTDs,
    published online in any format, converted to PDF, PostScript,
    RTF and other formats) must reproduce the above copyright
    notice, this list of conditions and the following disclaimer
    in the documentation and/or other materials provided with the
    distribution.
 
 THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
 BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
 OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
 OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
 OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
 QUICK GUIDE TO ADDING A NEW ENTRY
 
 1. run 'make newentry' to add a template to the top of the document
 2. fill in the template
 3. use 'make validate' to verify syntax correctness (you might need to install
    textproc/libxml2 for parser, and this port for catalogs)
 4. fix any errors
 5. use 'make VID=xxx-yyy-zzz html' to emit the entry's html file for formatting review
 6. profit!
 
 Additional tests can be done this way:
  $ make vuln-flat.xml
  $ pkg audit -f ./vuln-flat.xml py26-django-1.6
  $ pkg audit -f ./vuln-flat.xml py27-django-1.6.1
 
 Extensive documentation of the format and help with writing and verifying
 a new entry is available in The Porter's Handbook at:
 
   https://docs.freebsd.org/en/books/porters-handbook/security/#security-notify
 
 Help is also available from ports-security@freebsd.org.
 
 Notes:
 
   * Please add new entries to the beginning of the current year's file.
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+&vuln-2026;
 &vuln-2025;
 &vuln-2024;
 &vuln-2023;
 &vuln-2022;
 &vuln-2021;
 &vuln-2020;
 &vuln-2019;
 &vuln-2018;
 &vuln-2017;
 &vuln-2016;
 &vuln-2015;
 &vuln-2014;
 &vuln-2013;
 &vuln-2012;
 &vuln-2011;
 &vuln-2010;
 &vuln-2009;
 &vuln-2008;
 &vuln-2007;
 &vuln-2006;
 &vuln-2005;
 &vuln-2004;
 &vuln-2003;</vuxml>
 <!-- EOF -->
 <!-- Note:  Please add new entries to the beginning of this file. -->
 <!-- ex: set ts=8 tw=80 sw=2: -->
 <!-- vim: set softtabstop=2 noexpandtab: -->
diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
new file mode 100644
index 000000000000..1934457383fa
--- /dev/null
+++ b/security/vuxml/vuln/2026.xml
@@ -0,0 +1,27 @@
+  <vuln vid="500cc49c-e93b-11f0-b8d8-4ccc6adda413">
+    <topic>gstreamer1-plugins-bad -- Out-of-bounds reads in MIDI parser</topic>
+    <affects>
+<package>
+<name>gstreamer1-plugins-bad</name>
+<range><lt>1.26.10</lt></range>
+</package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The GStreamer Security Center reports:</p>
+	<blockquote cite="https://gstreamer.freedesktop.org/security/sa-2025-0009.html">
+	  <p>Multiple out-of-bounds reads in the MIDI parser that can cause
+	  crashes for certain input files.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2025-67326</cvename>
+      <cvename>CVE-2025-67327</cvename>
+      <url>https://gstreamer.freedesktop.org/security/sa-2025-0009.html</url>
+    </references>
+    <dates>
+      <discovery>2025-12-27</discovery>
+      <entry>2026-01-04</entry>
+    </dates>
+  </vuln>