rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation installrustbuster echo "Installing latest version o...

smuggler

/ | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to Ben Sadeghipour...

RLSA-2026:98616 Important: dpdk security update

The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fixes: dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor...

dpdk security update

An update is available for dpdk. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The dpdk packages provide the Data Plane Development Kit, which is a set of...

CVE-2021-35492

Exploit Information Exploit Title: Wowza Streaming Engine 4.8.11+5 - Denial of Service CVE: CVE-2021-35492 Date: 2021-10-06 Exploit Author: N4nj0 Software Link: https://www.wowza.com/products/streaming-engine Version: 4.8.11+5 Tested on: Wowza Streaming Engine = 4.8.11+5 Vulnerability Advisory:...

CVE-2026-74580

Vghost — CVE-2026-74580 Original code and readme file from: https://github.com/zhangutah/security-research linux privilege escalation Expected output: ./poc === vhost stale IOTLB metadata cache - modprobepath write === static: stext=0xffffffff81000000 asmexcde=0xffffffff81001030...

CVE-2026-74580

CVE-2026-74580 - LPE CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration - Exploit Exploit History I discovered this vulnerability three days after it had been reported by another researcher. However, I had already developed the exploit and chose not to release it until ...

vghost-watch

vghost-watch A perimeter-check and responsible-disclosure helper for CVE-2026-74580 "Vghost" — a real Linux kernel vhost metadata-cache bug CVE record, OSV entry that gives local-privesc / VM-escape on exposed vhost/hypervisor hosts. Primary use case: check your own perimeter. Feed in your own IP...

dpdk security update

An update is available for dpdk. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The dpdk packages provide the Data Plane Development Kit, which is a set of...

RLSA-2026:98505 Important: dpdk security update

The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fixes: dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor...

Rocky Linux 9 [CIQ] Security Update: dpdk / dpdk-debuginfo / dpdk-debugsource / dpdk-devel / dpdk-doc / etc Multiple Vulnerabilities (crlsa-2026_98505)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202698505 advisory. dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor double-fetch...

SUSE SLES15: dpdk / dpdk-devel / dpdk-kmp-default / dpdk-thunderx / etc (SUSE-SU-2026:5184-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5184-1 advisory. - CVE-2026-86561: missing memory size validation before mmap in vhost memory region setup bsc1285678. - CVE-2026-86563: double offs...

SUSE SLES15: dpdk / dpdk-devel / dpdk-thunderx / dpdk-thunderx-devel / etc (SUSE-SU-2026:5200-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5200-1 advisory. - CVE-2026-86561: missing memory size validation before mmap in vhost memory region setup bsc1285678. - CVE-2026-86562: double-fetc...

dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend...

Important: Red Hat Security Advisory: dpdk security update

An update for dpdk is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process...

dpdk: dpdk: Double offset bug in vhost log mapping calculation

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access...

dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap...