Skip to content
Threat Feed
Subscribe

Product

Knowns (< 0.30.0)

2 briefs RSS
critical advisory

Authentication Bypass in knowns Management API

The knowns application before version 0.30.0 exposes an unauthenticated management API on all network interfaces, allowing attackers to provision unauthorized tunnels via the /api/tunnel/start endpoint.

knowns +1 web-vulnerability path-traversal npm cve-2026-86775
2r 2t 1c updated
critical advisory

CVE-2026-86542 Path Traversal in knowns Application

An unauthenticated path traversal vulnerability in knowns versions prior to 0.30.0 allows attackers to overwrite arbitrary files on the server by supplying malicious traversal sequences in the import route name parameter.

knowns +1 remote-code-execution cve vulnerability path-traversal mcp
2r 6t 1c updated