Advisories · Technology

AUTOMATIC1111 stable-diffusion-webui.

Every CVE that names AUTOMATIC1111 stable-diffusion-webui among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-111987 CVE record

CVSS 5.3 Medium

AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting
- AUTOMATIC1111 stable-diffusion-webui
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Oct 2026
CVE-2026-111986 CVE record

CVSS 5.3 Medium

AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
- AUTOMATIC1111 stable-diffusion-webui
- Other injection
- Code injection
Not analysed yet 18 Oct 2026
CVE-2026-111985 CVE record

CVSS 5.3 Medium

AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources
- AUTOMATIC1111 stable-diffusion-webui
- Denial of service
Not analysed yet 18 Oct 2026
CVE-2026-111984 CVE record

CVSS 5.3 Medium

AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
- AUTOMATIC1111 stable-diffusion-webui
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Oct 2026
CVE-2026-82288 CVE record

CVSS 8.7 High

Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags
- AUTOMATIC1111 stable-diffusion-webui
- Hard-coded credentials
Not analysed yet 28 Aug 2026
CVE-2024-12074 CVE record

CVSS 6.5 Medium

Denial of Service in automatic1111/stable-diffusion-webui
- automatic1111/stable-diffusion-webui
- Denial of service
Not analysed yet 20 Mar 2025
CVE-2024-11045 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
- automatic1111/stable-diffusion-webui
- Broken access control
Not analysed yet 20 Mar 2025
CVE-2024-12375 CVE record

CVSS 6.5 Medium

Local File Inclusion in automatic1111/stable-diffusion-webui
- automatic1111/stable-diffusion-webui
- Path traversal
Not analysed yet 20 Mar 2025
CVE-2024-10935 CVE record

CVSS 7.5 High

Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
- automatic1111/stable-diffusion-webui
- Denial of service
Not analysed yet 20 Mar 2025
CVE-2024-11044 CVE record

CVSS 6.1 Medium

Open Redirect in automatic1111/stable-diffusion-webui
- automatic1111/stable-diffusion-webui
- Open redirect
Not analysed yet 20 Mar 2025
CVE-2024-12374 CVE record

CVSS 6.1 Medium

Stored XSS in automatic1111/stable-diffusion-webui
- automatic1111/stable-diffusion-webui
- Cross-site scripting (XSS)
Not analysed yet 20 Mar 2025
CVE-2024-31462 CVE record

CVSS 6.3 Medium

Limited file write in Stable-diffusion-webui - GHSL-2024-010
- AUTOMATIC1111 stable-diffusion-webui
- Path traversal
Not analysed yet 12 Apr 2024