Advisories · Technology
knowns.
Every CVE that names knowns among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint
- knowns
- Path traversal
- CVSS 8.7 High
knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption
- knowns
- Broken access control
- CVSS 7.1 High
knowns through 0.33.0 Path Traversal via code.find MCP tool
- knowns
- Path traversal
- CVSS 8.6 High
knowns through 0.33.0 Path Traversal via Template Engine
- knowns
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
- knowns
- Path traversal
- CVSS 8.8 High
knowns before 0.30.0 Path Traversal via Document API
- knowns
- Path traversal
- CVSS 7.2 High
knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions
- knowns
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
knowns before 0.30.0 Unauthenticated Management API Exposure
- knowns
- Authentication bypass
- CVSS 8.8 High
knowns before 0.30.0 Path Traversal via Import Name
- knowns
- Path traversal
- CVSS 7.2 High
knowns before 0.30.0 Path Traversal via code.replace MCP action
- knowns
- Path traversal
- CVSS 6.9 Medium
knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
- knowns
- Server-side request forgery (SSRF)
- CVSS 8.7 High
knowns before 0.30.0 Path Traversal via templateFile parameter
- knowns
- Path traversal