diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 202c3718bb..e79cf72eb0 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -19,6 +19,25 @@ ignore = [
     # Re-evaluate when the `rsa` crate ships a constant-time implementation.
     "RUSTSEC-2023-0071",
 
+    # quick-xml 0.26.0 — memory-exhaustion DoS via unbounded namespace-
+    # declaration allocation (RUSTSEC-2026-0195) and quadratic run time on
+    # duplicate-attribute checks (RUSTSEC-2026-0194), both severity 7.5.
+    # Pulled transitively only via `inferno` (flamegraph rendering) <-
+    # `pprof` (optional `profiling` feature of ruvector-bench, never a
+    # production dependency). No lockfile-only bump is possible: `pprof`
+    # 0.15.0 (the newest release on crates.io as of this review) still
+    # requires `inferno = "^0.11"`, and `inferno` 0.11.21 (the newest
+    # patch in that line) still requires `quick-xml = "^0.26"` — verified
+    # directly via `cargo update -p inferno`/`cargo update -p quick-xml`
+    # dry runs, not from changelog inspection alone. quick-xml here only
+    # parses profiler-internal XML on the local machine (never
+    # network-facing or attacker-supplied input), so the DoS surface is
+    # not reachable in our usage even before a fix ships. Re-review when
+    # `pprof` cuts a release depending on `inferno` >=0.12, or track
+    # https://github.com/jonhoo/inferno for a quick-xml bump.
+    "RUSTSEC-2026-0195",
+    "RUSTSEC-2026-0194",
+
     # ------------------------------------------------------------------
     # "Unmaintained" warnings (informational, not vulnerabilities)
     # ------------------------------------------------------------------
diff --git a/Cargo.lock b/Cargo.lock
index 361ce58a10..78fce2a48d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1846,9 +1846,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
diff --git a/deny.toml b/deny.toml
index f6fbf3ff75..1890f88722 100644
--- a/deny.toml
+++ b/deny.toml
@@ -125,6 +125,21 @@ ignore = [
     # 2026-08-01.
     "RUSTSEC-2026-0105",
 
+    # ttf-parser — unmaintained, upstream author stated no further fixes
+    # will be released (RUSTSEC-2026-0192); the advisory itself states
+    # "No safe upgrade is available!". Reaches the graph at three
+    # independent versions, none of them fixable by a version bump:
+    #   0.15.2 via rusttype 0.9.3 -> owned_ttf_parser (dev-only, scipix)
+    #   0.20.0 via plotters 0.3.7 -> criterion (dev-dep, workspace-wide) and
+    #           -> ruvector-bench's own chart rendering (publish = false)
+    #   0.25.1 via imageproc 0.25.1 -> ab_glyph -> owned_ttf_parser (scipix)
+    # All three paths are dev-dependencies or unpublished bench-only tooling,
+    # never linked into a published/production artifact; font-parsing
+    # inputs are local example assets, not attacker-controlled. Re-review
+    # 2026-08-01 or when a maintained fork (e.g. skrifa) is adopted by
+    # rusttype/plotters/imageproc upstream.
+    "RUSTSEC-2026-0192",
+
     # memmap2 0.9.x — unsound `Unchecked pointer offset` API (RUSTSEC-2026-0186,
     # "unsound", not an exploitable vuln). Transitive via safetensors/candle
     # mmap loading and other crates; no fixed release on the 0.9 line yet.