diff --git a/doc/changelog.rst b/doc/changelog.rst
index ad82e97516..2a044aaccd 100644
--- a/doc/changelog.rst
+++ b/doc/changelog.rst
@@ -6,10 +6,13 @@ Changes in Version 4.18.2 (2026/09/24)
 
 Version 4.18.2 is a bug fix release.
 
-- Hardened the bson buffer size guard against signed integer overflow.
-- Fixed connection string parsing to percent-decode each host individually.
-- Client-side field level encryption now rejects a KMS endpoint ending in
-  ``.sock``.
+- Hardened the bson buffer size guard against signed integer overflow. (`CVE-2026-96749`_).
+- Fixed connection string parsing to percent-decode each host individually. (`CVE-2026-96748`_).
+- Client-side field level encryption now rejects a KMS endpoint ending in ``.sock``. (`CVE-2026-96747`_).
+
+.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749
+.. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748
+.. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747
 
 Issues Resolved
 ...............