PULSEUnderground Intel

EN VIVO19señales / 24h

FEED

ransomn0n reclama a Telecom Egypt · EG · Technologyransomn0n reclama a All Business Technologies (Fox Hill bookkeeping and tax practice) · Professional Servicesransomn0n reclama a SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo... · US · Manufacturingransomqilin reclama a Llano Independent School District · US · Educationransomiah6477 reclama a mckenneys · US · Professional Servicesransomqilin reclama a BRUTRA Logistek · NL · Transportationransomqilin reclama a Pengurusan Aset Air Berhad · MY · Energy & Utilitiesransomqilin reclama a Pergande · DE · Not Foundransomqilin reclama a Mastelli S.r.l. · IT · Manufacturingransomn0n reclama a Company #91 · US · Not Foundransomhelix reclama a Southwire · US · Manufacturingransomemperador reclama a Luzco Ilumination · Energy & Utilitiesransomn0n reclama a Company #90 · US · Not Foundransomn0n reclama a Company #89 · US · Not Foundransomn0n reclama a Telecom Egypt · EG · Technologyransomn0n reclama a All Business Technologies (Fox Hill bookkeeping and tax practice) · Professional Servicesransomn0n reclama a SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo... · US · Manufacturingransomqilin reclama a Llano Independent School District · US · Educationransomiah6477 reclama a mckenneys · US · Professional Servicesransomqilin reclama a BRUTRA Logistek · NL · Transportationransomqilin reclama a Pengurusan Aset Air Berhad · MY · Energy & Utilitiesransomqilin reclama a Pergande · DE · Not Foundransomqilin reclama a Mastelli S.r.l. · IT · Manufacturingransomn0n reclama a Company #91 · US · Not Foundransomhelix reclama a Southwire · US · Manufacturingransomemperador reclama a Luzco Ilumination · Energy & Utilitiesransomn0n reclama a Company #90 · US · Not Foundransomn0n reclama a Company #89 · US · Not Found

← Todos los CVEs

CVE Watch18 oct 2026

CVE-2026-111987

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_met

CVSS

4.3

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 18 oct 2026 · Última mod.: 18 oct 2026 · CWE-79 · CWE-94

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1119916.3 MED

———A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.9h CVE-2026-1119866.3 MED

———A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.11h CVE-2026-1119844.3 MED

———A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.12h CVE-2026-1108977.1 ALT

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.13h CVE-2026-1108856.5 MED

———Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.13h CVE-2026-1103827.1 ALT

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.13h