Microsoft has listed CVE-2026-6276, a libcurl cookie-leak vulnerability disclosed by the curl project on April 29, 2026, in which applications reusing the same libcurl easy handle after a custom Host header could send cookies intended for one host to another. The flaw is narrow, but it lands in...