From the release notes for version 0.16.2:
Wallet
* #13622 c04a4a5 Remove mapRequest tracking that just effects Qt display. (TheBlueMatt)
* #12905 cfc6f74 [rpcwallet] Clamp walletpassphrase value at 100M seconds (sdaftuar)
* #13437 ed82e71 wallet: Erase wtxOrderd wtx pointer on removeprunedfunds (MarcoFalke)
RPC and other APIs
* #13451 cbd2f70 rpc: expose CBlockIndex::nTx in getblock(header) (instagibbs)
* #13507 f7401c8 RPC: Fix parameter count check for importpubkey (kristapsk)
* #13452 6b9dc8c rpc: have verifytxoutproof check the number of txns in proof structure (instagibbs)
* #12837 bf1f150 rpc: fix type mistmatch in listreceivedbyaddress (joemphilips)
* #12743 657dfc5 Fix csBestBlock/cvBlockChange waiting in rpc/mining (sipa)
GUI
* #12432 f78e7f6 [qt] send: Clear All also resets coin control options (Sjors)
* #12617 21dd512 gui: Show messages as text not html (laanwj)
* #12793 cf6feb7 qt: Avoid reseting on resetguisettigs=0 (MarcoFalke)
Build system
* #13544 9fd3e00 depends: Update Qt download url (fanquake)
* #12573 88d1a64 Fix compilation when compiler do not support __builtin_clz* (532479301)
Tests and QA
* #13061 170b309 Make tests pass after 2020 (bmwiedemann)
* #13192 79c4fff [tests] Fixed intermittent failure in p2p_sendheaders.py (lmanners)
* #13300 d9c5630 qa: Initialize lockstack to prevent null pointer deref (MarcoFalke)
* #13545 e15e3a9 tests: Fix test case streams_serializedata_xor Remove Boost dependency. (practicalswift)
* #13304 cbdabef qa: Fix wallet_listreceivedby race (MarcoFalke)
Miscellaneous
* #12887 2291774 Add newlines to end of log messages (jnewbery)
* #12859 18b0c69 Bugfix: Include for std::unique_ptr (luke-jr)
* #13131 ce8aa54 Add Windows shutdown handler (ken2812221)
* #13652 20461fc rpc: Fix that CWallet::AbandonTransaction would leave the grandchildren, etc. active (Empact)
From the release notes for version 0.16.3:
Consensus
* #14249 696b936 Fix crash bug with duplicate inputs within a transaction (TheBlueMatt, sdaftuar)
RPC and other APIs
* #13547 212ef1f Make signrawtransaction* give an error when amount is needed but missing (ajtowns)
Miscellaneous
* #13655 1cdbea7 bitcoinconsensus: invalid flags error should be set to bitcoinconsensus_err (afk11)
Documentation
* #1384411b9dbb correct the help output for -prune (hebasto)
This also fixes a denial-of-service vulnerability (CVE-2018-17144). It is
exploitable by miners and has been discovered in Bitcoin Core versions 0.14.0
up to 0.16.2. It is recommended to upgrade any of the vulnerable versions to
0.16.3 as soon as possible.
XXX pull-up (security fix)
a2cba8ad4c