turbolite

turbolite turboliteは、Rustで書かれたSQLite VFSで、S3から直接ポイントルックアップと結合を提供し、コールドレイテンシが250ms未満です。 このリポジトリは、以下の2つのクレートからなるCargoワークスペースです。 turbolite — 純粋なRustライブラリ。ページレベルの圧縮、暗号化、S3階層化を備えたSQLite VFS。 turbolite-ffi — C FFI / ロード可能な拡張 + 言語バインディング Python, Node.js, Go。...

karton

Karton Python, Redis 및 S3 기반의 분산 맬웨어 처리 프레임워크. 개념 Karton은 유연한 및 경량 맬웨어 분석 백엔드를 생성하기 위한 강력한 프레임워크입니다. 거의 노력 없이 맬웨어 분석 시스템을 강력한 파이프라인에 연결하는 데 사용할 수 있습니다. 우리는 오랫동안 자동화 분야에 종사해 왔습니다. 점점 더 많은 위협을 처리하고 있으며, 사고에 대응하기 위해 모든 것을 자동화해야 합니다. 이 때문에 우리는 종종 duck duct tape와 WD-40으로 붙인 많은 스크립트를 만들게 됩니다. 이러한 스크립트는...

amira

AMIRA: 자동화된 악성코드 침해 대응 및 분석 Automated Malware Incident Response & Analysis AMIRA는 OSXCollector 출력 파일에 대해 자동으로 분석을 실행하는 서비스입니다. 자동화된 분석은 OSXCollector Output Filters, 특히 모든 필터를 통합하는 하나의 필터 인 Analyze Filter를 통해 수행됩니다. AMIRA는 S3 버킷에서 출력 파일을 검색하고, Analyze Filter를 실행한 후 분석 결과를 다시 S3에 업로드하는 작업을 처리합니다 관련...

nuclearpond

Nuclear Pond Nuclear Pond는 클라우드에서 Nuclei를 평범한 속도, 유연성으로 활용하고, 커피 한 잔 값보다 훨씬 적은 비용으로 인터넷 전체 스캔을 수행하는 데 사용됩니다. 이는 백엔드로 AWS Lambda를 활용하여 Nuclei 스캔을 병렬로 호출하고, JSON 결과를 S3에 저장하여 AWS Athena로 쿼리할 수 있는 옵션을 제공하며, 클라우드에서 스캔을 실행할 수 있는 가장 저렴한 방법 중 하나입니다. Features 결과를 터미널, JSON 또는 S3로 출력 원하는 배치 수로 스레드 및 병렬 호출...

nuclearpond-OFJAAAH

Nuclear Pond V.2 私たちはこのプロジェクトをフォークし、この素晴らしいアイデアを継続できるようにしました。一緒にコードを改善し、誰もが利用できるようにできればと思います - @OFJAAAH Nuclear Pondをインストールするには、バックエンドのterraform moduleを設定する必要があります。これはterraform applyを実行するか、terragruntを利用して行えます。 AWS Lambdaをバックエンドとして利用してNucleiスキャンを並列に実行し、JSONの検出結果をS3に保存してAWS...

CVE-2026-90614

FedML-AI FedML versions up to 0.9.6 contain a deserialization vulnerability in the MQTT+S3 Communication Backend component. The flaw resides in the S3Storage.read_model function within fedml/core/distributed/communication/s3/remote_storage.py, where manipulation of the s3_key_str argument trigger...

CVE-2026-90614 FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

Security Bulletin: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

Summary Langflow uses a local and S3-backed storage service to manage files uploaded by users and referenced by flow components. The flow execution runtime accepts attacker-controlled file paths through the tweaks API without invoking the path containment guard, allowing traversal sequences to...

CVE-2026-48035 Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...

CVE-2026-42147: Server-Side Request Forgery (SSRF)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

Malicious Package

Overview @cloudplatform-single-spa/svp-s3-storage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the UploadAllFiles function during S3 restore operations when processing tar headers from a supplied backup archive. An attacker can cause the daemon to crash and disrupt the contr...

CVE-2026-28377

A flaw was found in Grafana Tempo. This vulnerability exposes the S3 Server-Side Encryption with Customer-Provided Keys SSE-C encryption key in plaintext through the /status/config endpoint. A remote attacker could exploit this to obtain the key, potentially allowing unauthorized access and...

CVE-2026-28377

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to williamgoodfellow for reporting this vulnerability...

Unspecified Vulnerability in StudioCMS (CNVD-2026-18150)

StudioCMS is StudioCMS open source a content management system . A security vulnerability exists in StudioCMS that can be exploited by an attacker to cause an authenticated user to perform arbitrary file operations on S3 storage buckets...

GHSA-MM78-FGQ8-6PGR StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

Summary The S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorizedtype always evaluates to false, completely bypassing the authorization check...

CVE-2026-32101 StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...

CVE-2026-32101

CVE-2026-32101 affects StudioCMS S3 Storage Manager prior to version 0.3.1. The isAuthorized() function is async but is called without await in both the POST and PUT handlers, causing the authorization check to always evaluate to bypass due to Promise objects being truthy. As a result, any authen...

CVE-2026-32101: Incorrect Authorization

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...

AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue

Summary S3 Encryption Client for PHP is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders...