PULSE
ES
FEED
ransomn0n reclama a Amagi Media Labs · US · Technologyransomqilin reclama a Belcorp · PE · Retail & E-Commerceransomn0n reclama a Company #92 · KR · Not Foundransomcloak reclama a ********rta.ch · CH · Not Foundransomcloak reclama a dac********er.de · DE · Not Foundransomn0n reclama a Telecom Egypt · EG · Technologyransomn0n reclama a All Business Technologies (Fox Hill bookkeeping and tax practice) · Professional Servicesransomn0n reclama a SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo... · US · Manufacturingransomqilin reclama a Llano Independent School District · US · Educationransomiah6477 reclama a mckenneys · US · Professional Servicesransomqilin reclama a BRUTRA Logistek · NL · Transportationransomqilin reclama a Pengurusan Aset Air Berhad · MY · Energy & Utilitiesransomqilin reclama a Pergande · DE · Not Foundransomqilin reclama a Mastelli S.r.l. · IT · Manufacturingransomn0n reclama a Amagi Media Labs · US · Technologyransomqilin reclama a Belcorp · PE · Retail & E-Commerceransomn0n reclama a Company #92 · KR · Not Foundransomcloak reclama a ********rta.ch · CH · Not Foundransomcloak reclama a dac********er.de · DE · Not Foundransomn0n reclama a Telecom Egypt · EG · Technologyransomn0n reclama a All Business Technologies (Fox Hill bookkeeping and tax practice) · Professional Servicesransomn0n reclama a SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo... · US · Manufacturingransomqilin reclama a Llano Independent School District · US · Educationransomiah6477 reclama a mckenneys · US · Professional Servicesransomqilin reclama a BRUTRA Logistek · NL · Transportationransomqilin reclama a Pengurusan Aset Air Berhad · MY · Energy & Utilitiesransomqilin reclama a Pergande · DE · Not Foundransomqilin reclama a Mastelli S.r.l. · IT · Manufacturing
← All CVEs
CVE WatchOct 19, 2026

CVE-2026-112031

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the fi

CVSS

3.5

Low

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Oct 19, 2026 · Last modified: Oct 19, 2026 · CWE-79 · CWE-94

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-112111—
—
——0The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.4hCVE-2026-1119916.3 MED
—
——0A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.12hCVE-2026-1119874.3 MED
—
——0A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.13hCVE-2026-1119866.3 MED
—
——0A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.14hCVE-2026-1119844.3 MED
—
——0A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.15hCVE-2026-1108977.1 HIG
—
——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.16h