CVE-2026-3479 — DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. T — CVE Database · The Intelligence Room