Microsoft kiota

• CVE-2026-105796 High 8.8 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators 0.9%
• CVE-2026-105795 Low 3.1 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests 1.2%
• CVE-2026-73851 Medium 6.1 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass) 2.3%
• CVE-2026-59867 High 7.1 Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref 2.4%
• CVE-2026-59866 Critical 9.3 Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName 1.4%
• CVE-2026-59864 Critical 9.3 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions 1.3%
• CVE-2026-59865 Critical 9.3 Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` 4.4%
• CVE-2026-59863 High 7.0 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF 1.4%
• CVE-2026-59859 High 8.7 Kiota: Code Generation Literal Injection in the PHP Generator 1.4%
• CVE-2026-59862 High 7.5 Kiota: Code Generation Literal Injection in the Python Generator 1.4%
• CVE-2026-59861 High 7.5 Kiota: Code Generation Literal Injection in Kiota Ruby Generator 2.0%
• CVE-2026-59860 High 8.7 Kiota: XML Doc-Comment Newline Breakout Code Injection 1.4%
• CVE-2026-41134 High 7.3 Kiota: Code Generation Literal Injection 0.4%