knowns
- Software type
- Developer tool
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/07/2026, knowns recorded 14 security vulnerabilities in the last 90 days, of which 12 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of knowns and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-88940knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpointCVE-2026-88939knowns through 0.33.0 Authorization Bypass via project.set Bootstrap ExemptionCVE-2026-88938knowns through 0.33.0 Path Traversal via code.find MCP toolCVE-2026-88937knowns through 0.33.0 Path Traversal via Template EngineCVE-2026-88899knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-88940knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint | Exploitation statusActively exploited | FixYes |
| SeverityMedium |
CVE-2026-88939knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption | Exploitation statusActively exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-88938knowns through 0.33.0 Path Traversal via code.find MCP tool | Exploitation statusActively exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-88937knowns through 0.33.0 Path Traversal via Template Engine | Exploitation statusActively exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-88899knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityCritical |
|---|
CVE-2026-86775knowns before 0.30.0 Path Traversal via Document API | Exploitation statusNot exploited | FixYes | Published09/09/2026 | SeverityHigh |
|---|
CVE-2026-86544knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions | Exploitation statusNot exploited | FixYes | Published09/07/2026 | SeverityHigh |
|---|
CVE-2026-86543knowns before 0.30.0 Unauthenticated Management API Exposure | Exploitation statusNot exploited | FixYes | Published09/07/2026 | SeverityCritical |
|---|
CVE-2026-86542knowns before 0.30.0 Path Traversal via Import Name | Exploitation statusNot exploited | FixYes | Published09/07/2026 | SeverityHigh |
|---|
CVE-2026-86541knowns before 0.30.0 Path Traversal via code.replace MCP action | Exploitation statusNot exploited | FixYes | Published09/07/2026 | SeverityHigh |
|---|
CVE-2026-86540knowns before 0.30.0 Arbitrary Code Execution via LSP Binary | Exploitation statusActively exploited | FixYes | Published09/07/2026 | SeverityHigh |
|---|
CVE-2026-86539knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint | Exploitation statusNot exploited | FixYes | Published09/07/2026 | SeverityMedium |
|---|
CVE-2026-86538knowns before 0.30.0 Path Traversal via templateFile parameter | Exploitation statusNot exploited | FixYes | Published09/07/2026 | SeverityHigh |
|---|
CVE-2026-86439knowns before 0.30.0 Path Traversal via MCP doc and memory tools | Exploitation statusNot exploited | FixYes | Published09/07/2026 | SeverityHigh |
|---|
14 Results | Page 1 of 1