knowns-dev knowns

• CVE-2026-88940 Medium 5.3 knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint 0.6%
• CVE-2026-88939 High 8.3 knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption 0.5%
• CVE-2026-88938 Medium 6.5 knowns through 0.33.0 Path Traversal via code.find MCP tool 0.5%
• CVE-2026-88937 High 8.8 knowns through 0.33.0 Path Traversal via Template Engine 0.7%
• CVE-2026-88899 Critical 9.8 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header 0.8%
• CVE-2026-86775 High 8.6 knowns before 0.30.0 Path Traversal via Document API 0.7%
• CVE-2026-86544 High 8.1 knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions 0.6%
• CVE-2026-86543 Critical 9.8 knowns before 0.30.0 Unauthenticated Management API Exposure 0.9%
• CVE-2026-86542 Critical 9.1 knowns before 0.30.0 Path Traversal via Import Name 0.7%
• CVE-2026-86541 High 8.3 knowns before 0.30.0 Path Traversal via code.replace MCP action 0.8%
• CVE-2026-86540 High 7.8 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary 0.2%
• CVE-2026-86539 High 7.2 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint 0.4%
• CVE-2026-86538 High 7.5 knowns before 0.30.0 Path Traversal via templateFile parameter 1.0%
• CVE-2026-86439 High 8.8 knowns before 0.30.0 Path Traversal via MCP doc and memory tools 1.1%