• CTR05-CPP. Use explicit cv- and ref-qualifiers on auto declarations in range-based for loops 
• EXP32-CPP. Do not rely on side effects in unevaluated operands 
• DCL40-CPP. Destructors and deallocation functions must be declared noexcept 
• MEM31-CPP. Properly deallocate dynamically allocated resources 
• MEM33-CPP. Explicitly initiate and terminate object lifetime when performing manual lifetime management 

Changed

• The definition of undefined behavior was updated to also cover cases in which the standard defines a construct to be ill-formed with no diagnostic required. This update brings our definition more in line with [into.compliance]p2, which states in part: "If a program contains a violation of a rule for which no diagnostic is required, this International Standard places no requirement on implementations with respect to that program." (This is roughly an identical definition to undefined behavior in [defns.undefined].)
• OOP39-CPP. Do not use pointer-to-member operators to access nonexistent members
  Substantive changes to the normative wording.
• DCL35-CPP. Overload allocation and deallocation functions as a pair in the same scope
  Substantive changes to the normative wording, added code examples. Was previously called "DCL35-CPP. Do not overload operator new in a different scope than operator delete."
• MEM03-CPP. Clear sensitive information stored in returned reusable resources
  Converted a CS involving std::string::clear()
  into an NCCE; the clear() function makes no guarantees regarding the values of the memory being cleared.
• MSC30-CPP. Do not use std::rand() for generating pseudorandom numbers
  Substantive changes to the code examples; minor updates to the normative wording. Was previously called "MSC30-CPP. Do not use the rand() function for generating pseudorandom numbers."
• MSC32-CPP. Ensure your random number generator is properly seeded
  Substantive changes to the code examples; updates to the normative wording to match that of the corresponding C rule.
• DCL32-CPP. Do not declare or define a reserved identifier
  Substantive changes to the normative wording and examples. Added an exception to the rule for idempotent macro definitions of reserved identifiers; these can be machine generated by tools such as autoconf and are harmless. Also added an exception for standard library implementers and compiler vendors.
• EXP33-CPP. Do not read uninitialized memory
  Substantive changes to the content of the rule; was previously called "EXP33-CPP. Do not reference uninitialized memory."
• CTR44-CPP. Predicate function objects should have pure call semantics 
• Substantive changes to the content of the rule; was previously called "CTR44-CPP. Predicate functors should not have non-static non-const data fields."

Removed

• ENV00-CPP. Do not store the pointer to the string returned by getenv()
  This recommendation is covered entirely by ENV00-C. Do not store objects that can be overwritten by multiple calls to getenv() and similar functions. 
• ENV01-CPP. Do not make assumptions about the size of an environment variable
  This recommendation is covered entirely by ENV01-C. Do not make assumptions about the size of an environment variable.
• SIG33-CPP. Do not recursively invoke the raise() function
  This rule is covered entirely by SIG30-C. Call only asynchronous-safe functions within signal handlers.
• SIG34-CPP. Do not call signal() from within interruptible signal handlers
  This rule is covered entirely by SIG34-C. Do not call signal() from within interruptible signal handlers.
• FLP37-CPP. Check floating point inputs for exceptional values
  This rule was a duplicate of FLP04-CPP. Check floating point inputs for exceptional values; a recommendation is more appropriate than a rule in this instance.
• ERR38-CPP. Deallocation functions must not throw exceptions and ERR33-CPP. Destructors must not throw exceptions
  These rules were replaced by DCL40-CPP. Destructors and deallocation functions must be declared noexcept.
• MEM41-CPP. Declare a copy constructor, a copy assignment operator, and a destructor in a class that manages resources
  The parts of this rule that are normatively enforceable are covered by MEM31-CPP. Properly deallocate dynamically allocated resources. The remainder of the rule may be resurrected as a recommendation in the future, focusing on the Rule of Three (Five).
• MEM34-CPP. Only free memory allocated dynamically and MEM39-CPP. Resources allocated by memory allocation functions must be released using the corresponding memory deallocation function
  These rules were combined and superseded by MEM31-CPP. Properly deallocate dynamically allocated resources.
• DCL36-CPP. Do not declare an identifier with conflicting linkage classifications
  This rule does not apply in C++ because the same entity cannot be declared with conflicting linkage classifications in a conforming implementation.

CERT Oracle Secure Coding Standard for Java