PULSE
EN
FEED
ransomn0n reclama a Telecom Egypt · EG · Technologyransomn0n reclama a All Business Technologies (Fox Hill bookkeeping and tax practice) · Professional Servicesransomn0n reclama a SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo... · US · Manufacturingransomqilin reclama a Llano Independent School District · US · Educationransomiah6477 reclama a mckenneys · US · Professional Servicesransomqilin reclama a BRUTRA Logistek · NL · Transportationransomqilin reclama a Pengurusan Aset Air Berhad · MY · Energy & Utilitiesransomqilin reclama a Pergande · DE · Not Foundransomqilin reclama a Mastelli S.r.l. · IT · Manufacturingransomn0n reclama a Company #91 · US · Not Foundransomhelix reclama a Southwire · US · Manufacturingransomemperador reclama a Luzco Ilumination · Energy & Utilitiesransomn0n reclama a Company #90 · US · Not Foundransomn0n reclama a Company #89 · US · Not Foundransomn0n reclama a Telecom Egypt · EG · Technologyransomn0n reclama a All Business Technologies (Fox Hill bookkeeping and tax practice) · Professional Servicesransomn0n reclama a SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo... · US · Manufacturingransomqilin reclama a Llano Independent School District · US · Educationransomiah6477 reclama a mckenneys · US · Professional Servicesransomqilin reclama a BRUTRA Logistek · NL · Transportationransomqilin reclama a Pengurusan Aset Air Berhad · MY · Energy & Utilitiesransomqilin reclama a Pergande · DE · Not Foundransomqilin reclama a Mastelli S.r.l. · IT · Manufacturingransomn0n reclama a Company #91 · US · Not Foundransomhelix reclama a Southwire · US · Manufacturingransomemperador reclama a Luzco Ilumination · Energy & Utilitiesransomn0n reclama a Company #90 · US · Not Foundransomn0n reclama a Company #89 · US · Not Found
← Todos los CVEs
CVE Watch18 oct 2026

CVE-2026-111984

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file

CVSS

4.3

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 18 oct 2026 · Última mod.: 18 oct 2026 · CWE-79 · CWE-94

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1119916.3 MED
—
———A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.9hCVE-2026-1119874.3 MED
—
———A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.10hCVE-2026-1119866.3 MED
—
———A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.11hCVE-2026-1108977.1 ALT
—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.13hCVE-2026-1108856.5 MED
—
———Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.13hCVE-2026-1103827.1 ALT
—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.13h