knowns-dev knowns vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Latest knowns-dev knowns vulnerabilities

CVE-2026-88940 — knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint (CVSS 5.3)
CVE-2026-88939 — knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption (CVSS 8.3)
CVE-2026-88938 — knowns through 0.33.0 Path Traversal via code.find MCP tool (CVSS 6.5)
CVE-2026-88937 — knowns through 0.33.0 Path Traversal via Template Engine (CVSS 8.8)
CVE-2026-88899 — knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header (CVSS 9.8)
CVE-2026-86775 — knowns before 0.30.0 Path Traversal via Document API (CVSS 8.6)
CVE-2026-86544 — knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions (CVSS 8.1)
CVE-2026-86543 — knowns before 0.30.0 Unauthenticated Management API Exposure (CVSS 9.8)
CVE-2026-86542 — knowns before 0.30.0 Path Traversal via Import Name (CVSS 9.1)
CVE-2026-86541 — knowns before 0.30.0 Path Traversal via code.replace MCP action (CVSS 8.3)
CVE-2026-86540 — knowns before 0.30.0 Arbitrary Code Execution via LSP Binary (CVSS 7.8)
CVE-2026-86539 — knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint (CVSS 7.2)
CVE-2026-86538 — knowns before 0.30.0 Path Traversal via templateFile parameter (CVSS 7.5)
CVE-2026-86439 — knowns before 0.30.0 Path Traversal via MCP doc and memory tools (CVSS 8.8)