Microsoft Microsoft.openapi.kiota.builder vulnerabilities

2 CVEs affecting Microsoft Microsoft.openapi.kiota.builder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-105796, published 2026-10-06.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-105795, published 2026-10-06. Low severity, CVSS 3.1. EPSS: 1.2% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI…
• CVE-2026-105796, published 2026-10-06. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them,…