CVE-2026-3644: Incomplete control character validation in http.cookies
CVE-2026-3644 is a vulnerability in Incomplete control character validation in http.cookies, rated Moderate by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.50% probability of exploitation activity in the next 30 days, higher than 43% of all scored vulnerabilities. Microsoft released the fix on 19 March 2026 in the March 2026 Patch Tuesday. It affects 8 products in 1 product family (Open Source Software).
CVE-2025-69720: The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. (Critical, CVSS 9.8)
CVE-2026-3381: Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib (Critical, CVSS 9.8)
CVE-2026-33937: Handlebars.js has JavaScript Injection via AST Type Confusion (Critical, CVSS 9.8)
CVE-2026-4176: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib (Critical, CVSS 9.8)
CVE-2026-34714: Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE. (Critical, CVSS 9.2)
CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code (High, CVSS 8.8)