CVE-2026-73072: reset sl_sal_first[] in set_sofo() so a spell file with an SN_SAL section before an SN_SOFO section cannot under-count the mapping lists and write past the allocation
CVE-2026-73076: forbid a .VimballRecord member filename and only execute well-formed delete commands when removing a vimball
CVE-2026-73078: escape the Ex command separator when netrw builds the Bookmarks, History and Targets menus