PgBouncer 1.26.0 patches three CVEs, two triggerable without authentication.