{"data":{"id":"c842b40d-173e-4bfc-ba2d-9ed4a9a047e1","title":"CVE-2026-82288: Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint","summary":"Stable Diffusion WebUI version 1.10.1 and earlier has a security flaw in the /sdapi/v1/cmd-flags endpoint (a web address that returns system settings) that exposes usernames and passwords in plain text. Attackers without needing to log in can access this endpoint to steal login credentials and then use them to break into the application.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82288","publishedAt":"2026-08-28T20:20:20.393Z","cveId":"CVE-2026-82288","cweIds":["CWE-522"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Stability AI"],"affectedVendorsRaw":["Stable Diffusion WebUI"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-28T20:20:20.393Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}