CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters Information published. EPSS 0.00 CVE-2026-6019 US Microsoft Security · 3. 6. 10:41