Security feed

24 October 2026

High

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Type: advisorySource: Official CVE List24 Oct 2026, 22:05 UTC

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command…

Products: token-optimizer-mcpCVEs: CVE-2026-55157

Medium

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Type: advisorySource: Official CVE List24 Oct 2026, 21:32 UTC

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mc…

Products: token-optimizer-mcpCVEs: CVE-2026-55156