en
Knowns.dev is a Vietnam-based open-source software team working in developer tooling for AI-native development. Its core project, , provides a local-first, self-hostable project context and memory layer that exposes structured knowledge to developers and AI assistants through command-line and MCP interfaces. The project is intended for individual developers and software teams.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScanAs of 09/19/2026, knowns-dev recorded 14 security vulnerabilities in the last 90 days across 1 products, including 12 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, knowns had the most security vulnerabilities in the knowns-dev ecosystem, with 14 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-88940knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint | Exploitation statusPublic exploit | FixYes | Affected productknowns | Published09/10/2026 | SeverityMedium |
CVE-2026-88939knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption | Exploitation statusPublic exploit | FixYes | Affected productknowns | Published09/10/2026 | SeverityHigh |
CVE-2026-88938knowns through 0.33.0 Path Traversal via code.find MCP tool | Exploitation statusPublic exploit | FixYes | Affected productknowns | Published09/10/2026 | SeverityHigh |
CVE-2026-88937knowns through 0.33.0 Path Traversal via Template Engine | Exploitation statusPublic exploit | FixYes | Affected productknowns | Published09/10/2026 | SeverityHigh |
CVE-2026-88899knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/10/2026 | SeverityCritical |
CVE-2026-86775knowns before 0.30.0 Path Traversal via Document API | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/09/2026 | SeverityHigh |
CVE-2026-86544knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/07/2026 | SeverityHigh |
CVE-2026-86543knowns before 0.30.0 Unauthenticated Management API Exposure | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/07/2026 | SeverityCritical |
CVE-2026-86542knowns before 0.30.0 Path Traversal via Import Name | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/07/2026 | SeverityHigh |
CVE-2026-86541knowns before 0.30.0 Path Traversal via code.replace MCP action | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/07/2026 | SeverityHigh |
CVE-2026-86540knowns before 0.30.0 Arbitrary Code Execution via LSP Binary | Exploitation statusPublic exploit | FixYes | Affected productknowns | Published09/07/2026 | SeverityHigh |
CVE-2026-86539knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/07/2026 | SeverityMedium |
CVE-2026-86538knowns before 0.30.0 Path Traversal via templateFile parameter | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/07/2026 | SeverityHigh |
CVE-2026-86439knowns before 0.30.0 Path Traversal via MCP doc and memory tools | Exploitation statusNot known exploited | FixYes | Affected productknowns | Published09/07/2026 | SeverityHigh |
