Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

91635 matches found

NVD
NVD•added 2026/09/28 6:17 p.m.•18 views

CVE-2026-55156

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

5.3CVSS0.00446EPSS
SaveExploits0References3
NVD
NVD•added 2026/09/28 6:17 p.m.•19 views

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

8.4CVSS0.00705EPSS
SaveExploits0References3
CVE
CVE•added 2026/09/28 5:48 p.m.•61 views

CVE-2026-55156

The token-optimizer-mcp dashboard HTTP server is vulnerable to an unauthenticated path traversal (CWE-22) in the /api/session-summary and /api/session-events endpoints. The root cause is the lack of authentication middleware and the direct concatenation of the user-supplied sessionId query parame...

5.3CVSS5.7AI score0.00446EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/09/28 5:48 p.m.•20 views

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

5.3CVSS5.7AI score0.00446EPSS
SaveExploits0References3
EUVD
EUVD•added 2026/09/28 5:48 p.m.•16 views

EUVD-2026-88398

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

5.3CVSS5.7AI score0.00446EPSS
SaveExploits0References3
osv_cve
osv_cve•added 2026/09/28 5:48 p.m.•15 views

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

5.3CVSS5.7AI score0.00446EPSS
SaveExploits0References5
Cvelist
Cvelist•added 2026/09/28 5:48 p.m.•43 views

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

5.3CVSS0.00446EPSS
SaveExploits0References3
EUVD
EUVD•added 2026/09/28 5:48 p.m.•15 views

EUVD-2026-88397

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

8.4CVSS6.3AI score0.00705EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/09/28 5:48 p.m.•14 views

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

8.4CVSS6.3AI score0.00705EPSS
SaveExploits0References3
CVE
CVE•added 2026/09/28 5:48 p.m.•67 views

CVE-2026-55157

The token-optimizer-mcp software is vulnerable to OS command injection in the smart_user tool (specifically the get-user-info operation) prior to version 5.1.0 . The root cause is the unsafe interpolation of a user-controlled username argument into a shell command executed via execAsync(). Becaus...

8.4CVSS6.3AI score0.00705EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/09/28 5:48 p.m.•44 views

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

8.4CVSS0.00705EPSS
SaveExploits0References3
Mend
Mend•added 2026/09/28 5:48 p.m.•7 views

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

8.6CVSS6.3AI score0.00705EPSS
SaveExploits0References6
osv_cve
osv_cve•added 2026/09/28 5:48 p.m.•16 views

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

8.4CVSS6.2AI score
SaveExploits0References5
Vulnrichment
Vulnrichment•added 2026/09/28 5:27 p.m.•15 views

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

6.5CVSS5.7AI score0.00407EPSS
SaveExploits0References6
CVE
CVE•added 2026/09/28 5:27 p.m.•29 views

CVE-2026-96740

A vulnerability exists in the StreamsHub Console for Apache Kafka where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys. This flaw allows a Console CR author to set config....

6.5CVSS5.7AI score0.00407EPSS
SaveExploits0References6
Cvelist
Cvelist•added 2026/09/28 5:27 p.m.•50 views

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

6.5CVSS0.00407EPSS
SaveExploits0References6
osv_cve
osv_cve•added 2026/09/28 5:27 p.m.•23 views

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

6.5CVSS5.7AI score
SaveExploits0References10
EUVD
EUVD•added 2026/09/28 5:27 p.m.•18 views

EUVD-2026-88379

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

6.5CVSS5.7AI score0.00407EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE•added 2026/09/28 5:17 p.m.•18 views

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

6.5CVSS5.7AI score0.00407EPSS
SaveExploits0References7
osv_go
osv_go•added 2026/09/28 4:43 p.m.•20 views

GO-2026-6530 Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot...

8.8CVSS5.8AI score0.00336EPSS
SaveExploits0References2
Rows per page
Query Builder