CVE-2026-110631

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty corepublickeys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to...

CVE-2026-110631

Komodo versions through 2.3.3 contain an authentication bypass vulnerability in the Periphery agent . The root cause is that the core_public_keys and passkeys lists fail open by default when left empty. This allows unauthenticated attackers reaching port 8120 to present any generated keypair to c...

CVE-2026-110631 Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty corepublickeys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to...

CVE-2026-110005

The Komodo version 2.2.0 platform contains an OS command injection vulnerability within the periphery agent's container-management functionality. An authenticated low-privileged user possessing Execute or Read plus Logs permissions on a managed server can exploit the DestroyContainer or SearchCon...

PT-2026-113310

Name of the Vulnerable Software and Affected Versions Komodo version 2.2.0 Description The periphery agent's container-management functionality allows an authenticated low-privileged user with Execute or Read and Logs permissions to perform OS command injection. By supplying shell metacharacters ...

Malicious code in camelot-ammv2-periphery (npm)

camelot-ammv2-periphery is a malicious npm package that impersonates Camelot DEX's AMM v2 periphery contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6321 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6321 Source advisory: OSV:GHSA-Q3J6-QGPJ-74H6...

Revisiting and Expanding the IPv6 Network Periphery: Global-Scale Measurement and Security Analysis

As IPv6 deployment accelerates, understanding the evolving security posture of network peripheries becomes increasingly important. A DSN 2021 study introduced the first large-scale discovery of IPv6 network peripheries, uncovering risks like service exposure and routing loops. However, its scope...

Malicious code in cro-defi-swap-periphery (npm)

The package cro-defi-swap-periphery was found to contain malicious code...

MAL-2025-17690 Malicious code in cro-defi-swap-periphery (npm)

The package cro-defi-swap-periphery was found to contain malicious code...

The Redundancy of Full Nodes in Bitcoin: a Network-Theoretic Demonstration of Miner-Centric Propagation Topologies

This paper formally examines the network structure of Bitcoin CORE BTC and Bitcoin Satoshi Vision BSV using complex graph theory to demonstrate that home-hosted full nodes are incapable of participating in or influencing the propagation topology. Leveraging established models such as scale-free...

Wrong implementations in ERC4626RouterBase contract

Lines of code Vulnerability details The ERC4626RouterBase contract contains a set of functions that act as wrappers for a ERC4626 contract, providing a base periphery functionality around a ERC4626 vault. There are a number of different flaws in the wrapped implementations of mint, deposit,...

QA Report

ensure modifier - require statement is commented out The ensureuint deadline modifier is used in multiple functions such as addLiquidity and removeLiquidity but the require statement is commented out, the modifier is essentially usesless. modifier ensureuint deadline //requiredeadline =...