GHSA-49MQ-FC6Q-3H46 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...

CVE-2026-73682

This CVE ID is rejected/not used as explicitly stated in the Initial Description.

CVE-2026-73682 Semaphore prior to version 2.18.20 OS Command Injection via git_url Repository Handling

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

CVE-2026-73682 Semaphore prior to version 2.18.20 OS Command Injection via git_url Repository Handling

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

GHSA-XHF4-832V-7XCR vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-71310 vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-19188 Haiwell IoT Cloud HMI Gateway OS Command Injection

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

CVE-2026-19188 Haiwell IoT Cloud HMI Gateway OS Command Injection

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

EUVD-2026-58755

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

CVE-2026-19188

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

GO-2026-4344 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-5233 vulnerabilities

Vulnerabilities for packages: cg...

GO-2025-3953 vulnerabilities

Vulnerabilities for packages: temporal...

GO-2026-4857 vulnerabilities

Vulnerabilities for packages: grafana...

GO-2025-3845 vulnerabilities

Vulnerabilities for packages: gatus...

CVE-2026-19771 Baicells EG3661M LuCI Web luci os command injection

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

EUVD-2026-58564

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

CVE-2026-19771

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

CVE-2026-19771

CVE-2026-19771 affects Baicells EG3661M with LuCI Web Interface (file /cgi-bin/luci). The vulnerability arises from manipulating the arguments MaxHops/Timeout/Size, enabling OS command injection. AttackVector is NETWORK with LOW complexity and none user interaction required; authenticated context...

PT-2026-71949

Name of the Vulnerable Software and Affected Versions Baicells EG3661M version BaiCE BQ6 2.0.5.3 NA Description An OS command injection flaw exists in the LuCI Web Interface component. A remote attacker can exploit this by manipulating the MaxHops, Timeout, or Size arguments within the...