Microsoft Microsoft.OpenApi.Kiota

• CVE-2026-105796 High 8.8 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators 0.9%
• CVE-2026-105795 Low 3.1 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests 1.2%