CPython tarfile, Emacs, MySQL and Syncope flaws

High-severity extraction and code-execution issues in CPython and Emacs led the day's security traffic, joined by unauthenticated SQL execution in MySQL Group Replication and multiple Apache Syncope authorization defects. Glibc advisories and a gpg.fail retrospective rounded out the disclosures.

CPython tarfile hard-link symlink bypass

CPython disclosed CVE-2026-82049 in which tarfile extraction filters still allow file modification and content disclosure when a hard link targets a symlink. An attacker can thereby reach or alter paths outside the intended extraction directory. Applications that unpack untrusted archives are exposed until the filter logic is corrected.

Incomplete Emacs fix for arbitrary code execution

An incomplete remediation of CVE-2024-53920 leaves Emacs open to arbitrary code execution through additional major modes and flymake. The earlier patch failed to close all entry points that process untrusted content. Users who open foreign files or enable those modes should install the revised fix.

MySQL Group Replication unauthenticated SQL execution

CVE-2026-60163 permits unauthenticated remote arbitrary SQL execution in MySQL Group Replication via the XCom layer when the IP allowlist admits an attacker. Under that configuration a remote party can issue SQL without credentials. Cluster operators must tighten allowlists and apply the available updates.

gpg.fail authors issue retrospective

The authors of gpg.fail published a retrospective that discloses details of a previously unreported remote code-execution flaw in gpgsm and a fixed libgcrypt RSASSA-PSS verification bug. The note expands the technical record of weaknesses found in OpenPGP tooling. Maintainers of mail and cryptography stacks gain additional context for residual risk assessment.

Glibc strfmon and tdelete advisories

The GNU C Library released security advisories for 2026-09-14 covering a buffer overflow in strfmon and an out-of-bounds write in tdelete. Both defects received formal notices on oss-security. Systems linked against affected glibc builds should incorporate the corresponding patches.

Apache Syncope cross-realm authorization bypass

Apache Syncope announced CVE-2026-73236, an authorization bypass in delegated administration caused by flawed realm prefix matching. A delegated administrator can obtain privileges outside the intended realm. Deployments that rely on delegated admin must upgrade to close the matching logic gap.

Apache Syncope JWT access-token takeover

CVE-2026-73178 lets Apache Syncope administrators retrieve and reuse JWT access tokens, enabling privilege escalation. The issue has been corrected in recent releases. Operators should confirm they run a fixed version to prevent token reuse.

Apache Syncope unauthorized role grants via delegation

CVE-2026-73470 allows delegating users in Apache Syncope 3.x and 4.x to grant roles they do not own. The delegation feature therefore permits unauthorized role assignment. Identity deployments using those releases need the available fixes.