- CVE-2026-3276: sort each combining-character run in unicodedata.normalize() with a counting sort once the run exceeds a length threshold, instead of the quadratic insertion sort, so crafted input with long runs of alternating canonical combining classes can no longer burn CPU - CVE-2026-8328: apply the CVE-2021-4189 PASV fix to ftplib.ftpcp() as well, taking the data connection address from the source socket's peer instead of the host the server advertises, unless trust_server_pasv_ipv4_address opts back in - CVE-2026-15806: scope urllib.request HTTPPasswordMgr credentials by URL scheme, so credentials registered for an https:// URL are no longer sent over http://; a bare authority still matches any scheme, keeping proxy authentication working - CVE-2026-7774: validate the written link target in tarfile's data filter, rejecting a link member that resolves to the destination directory itself and resolving symlink targets against the stripped member name, so crafted link entries can no longer redirect later members outside the destination - CVE-2026-82049: resolve the hard-link source with os.path.realpath() in tarfile's makelink_with_filter, so an archive holding a hard link to a symlink can no longer duplicate that symlink to a shallower path whose relative target escapes the destination