- CVE-2026-7774: tarfile: fix data_filter bypass via crafted link entries; validate the normalised link target that is actually written to disk, resolve symlink targets relative to the member name with trailing separators stripped, and reject link members (including symlinks with empty or directory-like names) that would replace the destination directory itself and redirect later members outside it - CVE-2026-8328: ftplib: apply the CVE-2021-4189 PASV anti-SSRF fix to ftpcp(): use the source server's real peer address instead of the attacker-controllable IPv4 address from the PASV reply unless trust_server_pasv_ipv4_address is set