apm vulnerabilities

2 known vulnerabilities in apm from Microsoft. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  apm: Improper Link Resolution Before File Access

  CVE-2026-45539May 15, 2026Microsoft

  Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transpa

• 7.1 High severity

  apm: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-44641May 15, 2026Microsoft

  Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, a