CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

25 matches found

NVD•added 2026/09/28 6:17 p.m.•19 views

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

8.4CVSS0.00705EPSS

SaveExploits0References3

NVD•added 2026/09/28 6:17 p.m.•16 views

CVE-2026-55156

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

5.3CVSS0.00446EPSS

SaveExploits0References3

Cvelist•added 2026/09/28 5:48 p.m.•40 views

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

5.3CVSS0.00446EPSS

SaveExploits0References3

Vulnrichment•added 2026/09/28 5:48 p.m.•20 views

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

5.3CVSS5.7AI score0.00446EPSS

SaveExploits0References3

EUVD•added 2026/09/28 5:48 p.m.•16 views

EUVD-2026-88398

5.3CVSS5.7AI score0.00446EPSS

SaveExploits0References3

osv_cve•added 2026/09/28 5:48 p.m.•14 views

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

5.3CVSS5.7AI score0.00446EPSS

SaveExploits0References5

CVE•added 2026/09/28 5:48 p.m.•59 views

CVE-2026-55156

The token-optimizer-mcp dashboard HTTP server is vulnerable to an unauthenticated path traversal (CWE-22) in the /api/session-summary and /api/session-events endpoints. The root cause is the lack of authentication middleware and the direct concatenation of the user-supplied sessionId query parame...

5.3CVSS5.7AI score0.00446EPSS

SaveExploits0References3

osv_cve•added 2026/09/28 5:48 p.m.•14 views

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

8.4CVSS6.2AI score

SaveExploits0References5

EUVD•added 2026/09/28 5:48 p.m.•15 views

EUVD-2026-88397

8.4CVSS6.3AI score0.00705EPSS

SaveExploits0References3

Vulnrichment•added 2026/09/28 5:48 p.m.•14 views

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

8.4CVSS6.3AI score0.00705EPSS

SaveExploits0References3

CVE•added 2026/09/28 5:48 p.m.•67 views

CVE-2026-55157

The token-optimizer-mcp software is vulnerable to OS command injection in the smart_user tool (specifically the get-user-info operation) prior to version 5.1.0 . The root cause is the unsafe interpolation of a user-controlled username argument into a shell command executed via execAsync(). Becaus...

8.4CVSS6.3AI score0.00705EPSS

SaveExploits0References3

Cvelist•added 2026/09/28 5:48 p.m.•44 views

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

8.4CVSS0.00705EPSS

SaveExploits0References3

Mend•added 2026/09/28 5:48 p.m.•7 views

CVE-2026-55157

8.6CVSS6.3AI score0.00705EPSS

SaveExploits0References6

Rapid7 Vulnerability Database (full)•added 2026/09/28 12:00 a.m.•12 views

CVE-2026-55156: Improper Limitation of a Pathname to a Restricted Directory

5.3CVSS5.7AI score0.00446EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2026/09/28 12:00 a.m.•13 views

CVE-2026-55157: Improper Neutralization of Special Elements used in an OS Command

8.4CVSS6.3AI score0.00705EPSS

SaveExploits0References2

Circl•added 2026/08/14 10:35 p.m.•21 views

CVE-2026-55157

creationtimestamp| type| source ---|---|--- 2026-08-14 22:35:05+00:00| published-proof-of-concept| https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46 2026-09-28 19:33:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5yltowrmqkkch...

8.4CVSS5.8AI score0.00705EPSS

SaveExploits0References2

Circl•added 2026/08/14 10:35 p.m.•20 views

CVE-2026-55156

creationtimestamp| type| source ---|---|--- 2026-08-14 22:35:02+00:00| published-proof-of-concept| https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-76pc-mqxp-3rq5...

5.3CVSS5.8AI score0.00446EPSS

SaveExploits0References1

osv_ghsa•added 2026/08/14 9:43 p.m.•24 views

GHSA-76PC-MQXP-3RQ5 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | Field | Value | | ---------------- | ----- | | Repository | ooples/token-optimizer-mcp | | Affected version | 5.0.1 commit 8137147 | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | |...

5.3CVSS6.1AI score0.00446EPSS

SaveExploits0References4

Github Security Blog•added 2026/08/14 9:43 p.m.•25 views

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

5.3CVSS6.1AI score0.00446EPSS

SaveExploits0References4Affected Software1

Github Security Blog•added 2026/08/14 9:42 p.m.•24 views

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...

8.4CVSS6.7AI score0.00705EPSS

SaveExploits0References4Affected Software1

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by