Vulnerabilities
Summary — last 7 days
New vulnerabilities5,046▲ 227 vs. last week
Critical / high2,147▼ 622 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)773▲ 710 vs. last week
More filters
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.3) | 0.73% | — | KomodoAIKomodo PeripheryAI | 10/14/2026 | 10/20/2026 | Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API… | |
| Deferred | High (8.8) | 1.1% | — | KomodoAI | 10/13/2026 | 10/20/2026 | The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the… | |
| Deferred | Medium (5.3) | 0.30% | — | KomodoAI | 8/28/2026 | 9/23/2026 | Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged… | |
| Modified | Medium (5) | 1.2% | — | Komodo CMS | 12/20/2005 | 6/16/2026 | SQL injection vulnerability in page.php in Komodo CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. | |
| Modified | Medium (5.8) | 1.9% | Exploit | Komodo CMS | 12/20/2005 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in the search engine in Komodo CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. |