# Knowns-Dev Knowns vulnerabilities

Source: https://junglewise.ai/threats/technologies/knowns  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/knowns.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 19 vulnerabilities in Knowns-Dev Knowns: 0 in the last 7 days and 17 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, Knowns header injection in API endpoint allows arbitrary filesystem access, was published on 10 September 2026. Nothing was published in the last eight weeks.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 17
- All time: 19 (4 critical, 0 exploited in the wild)

## About Knowns-Dev Knowns

A Node.js library for checking if a value is a known constant or type.

## Latest Knowns-Dev Knowns vulnerabilities

- [Knowns header injection in API endpoint allows arbitrary filesystem access](https://junglewise.ai/threats/knowns-header-injection-in-api-endpoint-allows-arbitrary-filesystem-688e00ce) (critical, CVSS 9.8, published 10 Sep 2026)
- [CVE-2026-88940: Knowns path traversal in workspace browse endpoint](https://junglewise.ai/threats/cve-2026-88940-knowns-path-traversal-in-workspace-browse-endpoint) (medium, CVSS 5.3, published 10 Sep 2026)
- [CVE-2026-88939: Knowns project.set privilege escalation via permission bypass](https://junglewise.ai/threats/cve-2026-88939-knowns-project-set-privilege-escalation-via-permission-bypass) (high, CVSS 8.3, published 10 Sep 2026)
- [CVE-2026-88938: knowns path traversal in code.find MCP tool](https://junglewise.ai/threats/cve-2026-88938-knowns-path-traversal-in-code-find-mcp-tool) (medium, CVSS 6.5, published 10 Sep 2026)
- [CVE-2026-88937: knowns path traversal in code generation template engine](https://junglewise.ai/threats/cve-2026-88937-knowns-path-traversal-in-code-generation-template-engine) (high, CVSS 8.8, published 10 Sep 2026)
- [CVE-2026-88899: Knowns path traversal in /api/opencode proxy endpoint](https://junglewise.ai/threats/cve-2026-88899-knowns-path-traversal-in-api-opencode-proxy-endpoint) (critical, CVSS 9.8, published 10 Sep 2026)
- [CVE-2026-86775: knowns path traversal in Document API](https://junglewise.ai/threats/cve-2026-86775-knowns-path-traversal-in-document-api) (high, CVSS 8.6, published 9 Sep 2026)
- [knowns path traversal in MCP tools](https://junglewise.ai/threats/knowns-path-traversal-in-mcp-tools-d0d52c05) (high, CVSS 8.8, published 8 Sep 2026)
- [knowns command injection in LSP binary configuration](https://junglewise.ai/threats/duplicate-advisory-knowns-vulnerable-to-command-injection-3c0a4ee5) (high, CVSS 7.8, published 8 Sep 2026)
- [CVE-2026-86544: Knowns authorization bypass via code.replace mutation](https://junglewise.ai/threats/cve-2026-86544-knowns-authorization-bypass-via-code-replace-mutation) (high, CVSS 8.1, published 7 Sep 2026)
- [CVE-2026-86543: knowns management API authentication bypass](https://junglewise.ai/threats/cve-2026-86543-knowns-management-api-authentication-bypass) (critical, CVSS 9.8, published 7 Sep 2026)
- [CVE-2026-86542: knowns path traversal in import routes](https://junglewise.ai/threats/cve-2026-86542-knowns-path-traversal-in-import-routes) (critical, CVSS 9.1, published 7 Sep 2026)
- [CVE-2026-86541: Knowns path traversal in handleCodeReplace function](https://junglewise.ai/threats/cve-2026-86541-knowns-path-traversal-in-handlecodereplace-function) (high, CVSS 8.3, published 7 Sep 2026)
- [CVE-2026-86540: knowns arbitrary binary execution via unvalidated LSP settings](https://junglewise.ai/threats/cve-2026-86540-knowns-arbitrary-binary-execution-via-unvalidated-lsp-settings) (high, CVSS 7.8, published 7 Sep 2026)
- [CVE-2026-86539: knowns server-side request forgery in embedding model test endpoint](https://junglewise.ai/threats/cve-2026-86539-knowns-server-side-request-forgery-in-embedding-model-test) (high, CVSS 7.2, published 7 Sep 2026)
- [CVE-2026-86538: knowns path traversal in POST /api/templates/preview](https://junglewise.ai/threats/cve-2026-86538-knowns-path-traversal-in-post-api-templates-preview) (high, CVSS 7.5, published 7 Sep 2026)
- [CVE-2026-86439: knowns directory traversal in MCP tool path arguments](https://junglewise.ai/threats/cve-2026-86439-knowns-directory-traversal-in-mcp-tool-path-arguments) (high, CVSS 8.8, published 7 Sep 2026)
- [CVE-2026-30633: knowns-dev knowns directory traversal in get_doc and update_doc tools](https://junglewise.ai/threats/cve-2026-30633-knowns-dev-knowns-directory-traversal-in-get-doc-and-update-doc) (info, CVSS 5.3, published 21 Jul 2026)
- [CVE-2026-30632: knowns-dev knowns directory traversal in create_doc tool](https://junglewise.ai/threats/cve-2026-30632-knowns-dev-knowns-directory-traversal-in-create-doc-tool) (info, CVSS 5.3, published 21 Jul 2026)

## Most severe Knowns-Dev Knowns vulnerabilities

- [CVE-2026-86543: knowns management API authentication bypass](https://junglewise.ai/threats/cve-2026-86543-knowns-management-api-authentication-bypass) (critical, CVSS 9.8, published 7 Sep 2026)
- [CVE-2026-88899: Knowns path traversal in /api/opencode proxy endpoint](https://junglewise.ai/threats/cve-2026-88899-knowns-path-traversal-in-api-opencode-proxy-endpoint) (critical, CVSS 9.8, published 10 Sep 2026)
- [Knowns header injection in API endpoint allows arbitrary filesystem access](https://junglewise.ai/threats/knowns-header-injection-in-api-endpoint-allows-arbitrary-filesystem-688e00ce) (critical, CVSS 9.8, published 10 Sep 2026)
- [CVE-2026-86542: knowns path traversal in import routes](https://junglewise.ai/threats/cve-2026-86542-knowns-path-traversal-in-import-routes) (critical, CVSS 9.1, published 7 Sep 2026)
- [CVE-2026-86439: knowns directory traversal in MCP tool path arguments](https://junglewise.ai/threats/cve-2026-86439-knowns-directory-traversal-in-mcp-tool-path-arguments) (high, CVSS 8.8, published 7 Sep 2026)
- [CVE-2026-88937: knowns path traversal in code generation template engine](https://junglewise.ai/threats/cve-2026-88937-knowns-path-traversal-in-code-generation-template-engine) (high, CVSS 8.8, published 10 Sep 2026)
- [knowns path traversal in MCP tools](https://junglewise.ai/threats/knowns-path-traversal-in-mcp-tools-d0d52c05) (high, CVSS 8.8, published 8 Sep 2026)
- [CVE-2026-86775: knowns path traversal in Document API](https://junglewise.ai/threats/cve-2026-86775-knowns-path-traversal-in-document-api) (high, CVSS 8.6, published 9 Sep 2026)
- [CVE-2026-86541: Knowns path traversal in handleCodeReplace function](https://junglewise.ai/threats/cve-2026-86541-knowns-path-traversal-in-handlecodereplace-function) (high, CVSS 8.3, published 7 Sep 2026)
- [CVE-2026-88939: Knowns project.set privilege escalation via permission bypass](https://junglewise.ai/threats/cve-2026-88939-knowns-project-set-privilege-escalation-via-permission-bypass) (high, CVSS 8.3, published 10 Sep 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 17 | 4 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Knowns-Dev Knowns vulnerabilities", https://junglewise.ai/threats/technologies/knowns, 9 November 2026.