- CVE-2026-0864: normalize CR/CRLF line endings in configparser writes to prevent key/value injection - CVE-2026-1502: reject CR/LF in http.client proxy CONNECT tunnel host and headers - CVE-2026-3276: fix O(n^2) canonical ordering in unicodedata.normalize() (DoS on crafted combining sequences) - CVE-2026-6019: percent-encode cookie values embedded in http.cookies js_output() to prevent script injection (XSS) - CVE-2026-7774: validate written link target in tarfile data filter to prevent path traversal - CVE-2026-8328: apply CVE-2021-4189 PASV peer-address check to ftplib.ftpcp() to prevent data-connection SSRF - CVE-2026-11940: fix symlink escape via tarfile hardlink-extraction fallback (path traversal) - CVE-2026-11972: make tarfile._Stream.seek() break at EOF to prevent infinite-loop DoS on crafted stream archives