PT-2026-79393

to abs path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is path trusted in scripts/iib/api.py...

PT-2026-79392

Name of the Vulnerable Software and Affected Versions Stable Diffusion WebUI affected versions not specified Description The is path trusted function in scripts/iib/api.py improperly validates requested paths by using path.startswithparent path without appending a path separator. This allows acce...

CVE-2026-77814: Improper Limitation of a Pathname to a Restricted Directory

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...

CVE-2026-77815: Improper Link Resolution Before File Access

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

CVE-2026-19505

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

CVE-2026-19507

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

CVE-2026-19508

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19506

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

CVE-2026-19509

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-19508 RDK WebUI heap-based buffer overflow vulnerability

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

EUVD-2026-62718

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19508 RDK WebUI heap-based buffer overflow vulnerability

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19509 RDK WebUI DOS vulnerability

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-19509

The RDK-B WebUI (version rdkb-2025q4-kirkstone.04.10.26) contains a vulnerability in the ajaxSet_wireless_network_configuration.jst handler due to improper input validation of the ssid_number parameter. An authenticated administrator can supply an abnormally large value, leading to memory corrupt...

EUVD-2026-62716

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-19509 RDK WebUI DOS vulnerability

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-19507 RDK WebUI uncontrolled resource consumption

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

CVE-2026-19507

The RDK-B WebUI (version rdkb-2025q4-kirkstone.04.10.26) contains a vulnerability in the /usr/www2/check.jst login handler due to uncontrolled resource consumption . The application fails to limit the length of submitted passwords and performs SHA-256 hashing on the entire input string. A remote,...

CVE-2026-19507 RDK WebUI uncontrolled resource consumption

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

EUVD-2026-62715

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...