Update changelog

[skip ci]

Author: alecpl

CHANGELOG.md

@@ -8,13 +8,13 @@ This file includes only changes we consider noteworthy for users, admins and plu
 - Fix so the `oauth_password_claim` claim is retrieved via token or userinfo request (#9631)
 - Fix bug where `static.php` would return a 416 error on a specific `Range` request (#10194)
 - Fix bug where configured skin logo wasn't loaded via `static.php` resulting in 404 error (#10191)
-- Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
 - Fix bug where installto.sh would fail if public_html folder does not exist in the target directory (#10202)
 - Revert "Prefer 8bit over quoted-printable for HTML parts, when force_7bit is disabled (#8477)" (#10198)
 - Fix incorrect unfolding of folded lines when importing vCard 2.1 contacts (#9647)
 - Fix bug where Imagick could leave large temporary files on failure (#10230)
 - Fix bug where redis/memcache session could have been updated more often than needed
 - Fix support for untyped tokens in OIDC backchannel logout, require unset `nonce` (#10097)
+- Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
 - Security: Fix various vulnerabilities in the password plugin using session-injected username
 - Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
 - Security: Fix SSRF bypass via specific local address URLs - two new cases