EUVD-2026-56156

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control...

BIT-SEAWEEDFS-2026-77317 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...

[SECURITY] Fedora 44 Update: ceph-20.2.4-1.fc44

Ceph is a massively scalable, open-source, distributed storage system that ru ns on commodity hardware and delivers object, block and file system storage...

[SECURITY] Fedora 43 Update: ceph-19.2.6-1.fc43

Ceph is a massively scalable, open-source, distributed storage system that ru ns on commodity hardware and delivers object, block and file system storage...

CVE-2026-72920

CVE-2026-72920 affects SeaweedFS before version 4.24. The SeaweedIdentityAccessManagement gRPC service is registered without mandatory authentication when jwt.filer_signing.key is unset, allowing any client able to reach the filer’s gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and ...

PT-2026-58927

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated...

kernel: ceph: kernel: Ceph: exploit of hardcoded IVECs, in a misuse of AES, resulting in authentication bypass

A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication HMAC, making it vulnerable to the same class of unauthenticated-encryption attacks that...

EUVD-2026-32999

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFSCORSALLOWEDORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and...

PT-2026-44474

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring authentication. The endpoint is registered on the console listener and returns JSON containing license...

PT-2026-44467

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get shared secret in crates/ecstore/src/rpc/http auth.rs, falls back...

DeepFake Forensics AI: A Multi-Modal Detection and Blockchain-Anchored Evidence Management Platform

The proliferation of AI-generated synthetic media poses a critical threat to the integrity of digital evidence in legal and forensic contexts. Existing deepfake detection systems typically address a single modality and provide no mechanism for tamper-proof evidence preservation. We present DeepFa...

RustFS Insufficient Validation Data Compromise

The vulnerability of the distributed data storage system RustFS is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of the protected information...

RustFS http_auth.rs Unauthorized Access

The vulnerability of the httpauth.rs script in the distributed RustFS storage system is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-22043

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed denyonly short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privilege...

PT-2026-2144

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78 Description RustFS is a distributed object storage system built in Rust. A flaw in the deny only short-circuit within RustFS IAM allows a restricted service account or STS credential to...

NVIDIA AIStore AuthN Privilege Escalation

The vulnerability of the AuthN component in the NVIDIA AIStore distributed storage system for AI-based applications relates to the use of pre-installed credentials. Exploiting this vulnerability could allow an attacker to enhance their privileges and gain unauthorized access to protected...

Storage Spaces Direct Disclosure Sensitive Information

The vulnerability of the Storage Spaces Direct distributed storage function in Windows operating systems is related to the disclosure of information. Exploiting this vulnerability can allow an attacker to disclose protected information...

EUVD-2024-54839

Malicious code in bioql PyPI...

Yotta: a Large-Scale Trustless Data Trading Scheme for Blockchain System

Data trading is one of the key focuses of Web 3.0. However, all the current methods that rely on blockchain-based smart contracts for data exchange cannot support large-scale data trading while ensuring data security, which falls short of fulfilling the spirit of Web 3.0. Even worse, there is...

Blockchain Application in Metaverse: a Review

In recent years, the term Metaverse emerged as one of the most compelling concepts, captivating the interest of international companies such as Tencent, ByteDance, Microsoft, and Facebook. These company recognized the Metaverse as a pivotal element for future success and have since made significa...