turbolite

turbolite turbolite is a SQLite VFS in Rust that serves point lookups and joins directly from S3 with sub-250ms cold latency. This repo is a Cargo workspace with two crates: turbolite — Pure Rust library. SQLite VFS with page-level compression, encryption, and S3 tiering. turbolite-ffi — C FFI /...

amira

AMIRA: Automated Malware Incident Response & Analysis AMIRA is a service for automatically running the analysis on the OSXCollector output files. The automated analysis is performed via OSXCollector Output Filters, in particular The One Filter to Rule Them All : the Analyze Filter. AMIRA takes ca...

karton

Karton Distributed malware processing framework based on Python, Redis and S3. The idea Karton is a robust framework for creating flexible and lightweight malware analysis backends. It can be used to connect malware analysis systems into a robust pipeline with very little effort. We've been in th...

nuclearpond-OFJAAAH

Nuclear Pond V.2 Hicimos un fork de este proyecto para poder continuar con esta gran idea, espero que juntos podamos mejorar el código y hacerlo disponible para todos - @OFJAAAH Para instalar Nuclear Pond, necesitas configurar el backend módulo de terraform. Puedes hacerlo ejecutando terraform...

nuclearpond

Nuclear Pond Nuclear Pond is used to leverage Nuclei in the cloud with unremarkable speed, flexibility, and perform internet wide scans for far less than a cup of coffee. It leverages AWS Lambda as a backend to invoke Nuclei scans in parallel, choice of storing json findings in s3 to query with A...

CVE-2026-90614

FedML-AI FedML versions up to 0.9.6 contain a deserialization vulnerability in the MQTT+S3 Communication Backend component. The flaw resides in the S3Storage.read_model function within fedml/core/distributed/communication/s3/remote_storage.py, where manipulation of the s3_key_str argument trigger...

CVE-2026-90614 FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

Security Bulletin: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

Summary Langflow uses a local and S3-backed storage service to manage files uploaded by users and referenced by flow components. The flow execution runtime accepts attacker-controlled file paths through the tweaks API without invoking the path containment guard, allowing traversal sequences to...

CVE-2026-48035 Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...

CVE-2026-42147: Server-Side Request Forgery (SSRF)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

Malicious Package

Overview @cloudplatform-single-spa/svp-s3-storage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the UploadAllFiles function during S3 restore operations when processing tar headers from a supplied backup archive. An attacker can cause the daemon to crash and disrupt the contr...

CVE-2026-28377

A flaw was found in Grafana Tempo. This vulnerability exposes the S3 Server-Side Encryption with Customer-Provided Keys SSE-C encryption key in plaintext through the /status/config endpoint. A remote attacker could exploit this to obtain the key, potentially allowing unauthorized access and...

CVE-2026-28377

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to williamgoodfellow for reporting this vulnerability...

Unspecified Vulnerability in StudioCMS (CNVD-2026-18150)

StudioCMS is StudioCMS open source a content management system . A security vulnerability exists in StudioCMS that can be exploited by an attacker to cause an authenticated user to perform arbitrary file operations on S3 storage buckets...

GHSA-MM78-FGQ8-6PGR StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

Summary The S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorizedtype always evaluates to false, completely bypassing the authorization check...

CVE-2026-32101 StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...

CVE-2026-32101

CVE-2026-32101 affects StudioCMS S3 Storage Manager prior to version 0.3.1. The isAuthorized() function is async but is called without await in both the POST and PUT handlers, causing the authorization check to always evaluate to bypass due to Promise objects being truthy. As a result, any authen...

CVE-2026-32101: Incorrect Authorization

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...

AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue

Summary S3 Encryption Client for PHP is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders...