The CLN things now are extra protocol (and dumb) features. The embargo from a few weeks ago, seems to be not one critical thing but a multitude of low hanging fruit bad implementation griefs. Also noteworthy CLN may be the least popular implementation and for good reason.

No macaroon vuln to my knowledge, not that macs are lightning specific.

The BTCPay bug that could leak node connection into, including macaroons, is PoS software that does too much and operator error for giving it full node access.

What bolt11 thing?

Swaps are not lightning, though convenient and potentially cost effective, it's a lot of surface extra lightning and the swap services effected by vulns were because they handled liquid (studied peerswap myself and found that as per another thread here)

Splicing seemed silly under its original narrative of growing channels, but the swap replacement fit now makes sense especially where swap outs are way more commonly used. Iirc it's now spec ratified, so we'll have to see if that survives the cradle.