CVE-2026-46383Medium 5.5Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`0.4%
CVE-2026-45539High 7.4Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree0.7%
CVE-2026-44641High 7.1Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install0.4%