Medium
CVE-2026-105748
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 24
Reset filters
Medium
ghsa-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
Medium
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Medium
CVE-2026-105750
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
Medium
CVE-2026-105743
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
High
CVE-2026-105744
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Medium
CVE-2026-105746
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/
Medium
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Medium
CVE-2026-105745
Docling imports plugin entry points before the allow_external_plugins check
Medium
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Low
CVE-2026-105742
Docling: Configured HTTP headers sent to every remote image host named by a document
High
CVE-2026-44023
Docling Core: Unsafe remote filename resolution
High
CVE-2026-44019
Docling Core: Insufficient validation of image reference URIs
High
CVE-2026-31248
Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
High
CVE-2026-31247
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks
Medium
CVE-2026-44520
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
High
CVE-2026-24009
docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage
High
CVE-2026-47214
Docling: Unsafe URI and Path Handling in HTML Backend
Medium
CVE-2026-44018
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Medium
CVE-2026-44022
Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
High
CVE-2026-44017
Docling: Unsafe Zip Extraction in EasyOCR Model Download
High
CVE-2026-44020
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
High
CVE-2026-44016
Docling: Unsafe Playwright-based HTML Rendering
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.