Semantic Kernel
Approved changes feed: RSS · Atom
cpe:2.3:a:microsoft:semantic-kernel:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Microsoft (67206627-3ef6-5870-9d98-26a9f2e7065c) |
|---|---|
| Product | Semantic Kernel (76ce0f56-1770-520d-824e-9e1fcfa98560) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26030 |
vulnerable | 2026-06-08 07:53:20.744147 |
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
CRITICAL (10)
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.
Published: 2026-02-19T16:00:55.623Z
Updated: 2026-02-26T14:44:14.276Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25592 |
vulnerable | 2026-06-08 07:53:20.073346 |
Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK
CRITICAL (10)
Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. The problem has been fixed in Microsoft.SemanticKernel.Core version 1.71.0. As a mitigation, users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync or UploadFileAsync and ensures the provided localFilePath is allow listed.
Published: 2026-02-06T20:38:28.770Z
Updated: 2026-02-18T23:32:54.483Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.