CVE-2026-111987

A Cross-Site Scripting (XSS) vulnerability exists in AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1 . The flaw is located within the Extra-Networks Card Builder component, specifically in the read_metadata_from_safetensors function of the modules/sd_models.py file. An attacker can trig...

EUVD-2026-103507

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function readmetadatafromsafetensors of the file modules/sdmodels.py of the component Extra-Networks Card Builder. Such manipulation of the argument metadata.sshsmodelhash...

CVE-2026-111986

The AUTOMATIC1111 stable-diffusion-webui (up to version 1.10.1 ) is vulnerable to a code injection flaw within the Model Instantiation component. Specifically, the get_obj_from_str function in modules/sd_models.py fails to properly handle the Target argument, allowing an attacker to initiate a re...

CVE-2026-111986 AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function getobjfromstr of the file modules/sdmodels.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. T...

EUVD-2026-103506

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function getobjfromstr of the file modules/sdmodels.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. T...

CVE-2026-111985

A vulnerability exists in AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1 within the Metadata Extraction component. Specifically, the read_metadata_from_safetensors function in the modules/sd_models.py file is susceptible to resource allocation issues. An attacker can manipulate the hea...

EUVD-2026-103476

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function readmetadatafromsafetensors of the file modules/sdmodels.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It i...

CVE-2026-111984

The AUTOMATIC1111 stable-diffusion-webui software (up to version 1.10.1 ) contains a cross-site scripting (XSS) vulnerability within the Card Builder component. The flaw exists in the create_item_html function located in the modules/ui_extra_networks.py file, where improper handling of the filena...

EUVD-2026-103475

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function createitemhtml of the file modules/uiextranetworks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate t...

EUVD-2025-7011

Malicious code in bioql PyPI...

EUVD-2025-7060

Malicious code in bioql PyPI...

CVE-2024-12374

A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...

CVE-2024-12375

A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c. This vulnerability allows an attacker to read arbitrary files on the system by sending a specially crafted request to the application...

CVE-2024-11044

An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user...

CVE-2024-10935

automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary,...

CVE-2024-12074 Denial of Service in automatic1111/stable-diffusion-webui

A Denial of Service DoS vulnerability was discovered in the file upload feature of automatic1111/stable-diffusion-webui version 1.10.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large...

CVE-2024-11045

A Cross-Site WebSocket Hijacking CSWSH vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at...

CVE-2024-12375

A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c. This vulnerability allows an attacker to read arbitrary files on the system by sending a specially crafted request to the application...

CVE-2024-10935

automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary,...

CVE-2024-11044

An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user...