Skip to content
Docling vulnerabilities
Newest
-
docling
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
CVE-2026-105751
Fix available
6.9 Medium
-
docling, docling-project docling-slim +1 more
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
CVE-2026-105750
Fix available
5.9 Medium
-
docling, docling-project docling-slim +1 more
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
CVE-2026-105749
Fix available
6.5 Medium
-
docling, docling-project docling-slim +1 more
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
CVE-2026-105748
Fix available
4.3 Medium
-
docling, docling-project docling-slim +1 more
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
CVE-2026-105747
Fix available
4.3 Medium
-
docling, docling-project docling-slim +1 more
Docling: KServe v2 OCR engine does not enforce enable_remote_services
CVE-2026-105746
Fix available
2.2 Low
-
docling, docling-project docling-slim +1 more
Docling: Plugin entry points are imported before the allow_external_plugins check
CVE-2026-105745
Fix available
6.7 Medium
-
docling, docling-project docling-slim +1 more
Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
CVE-2026-105744
Fix available
7.5 High
-
docling, docling-project docling-slim +1 more
Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
CVE-2026-105743
Fix available
4.0 Medium
-
docling, docling-project docling-slim +1 more
Docling: Configured HTTP headers sent to every remote image host named by a document
CVE-2026-105742
Fix available
3.7 Low
-
docling docling-core
Docling Core has unsafe remote filename resolution
CVE-2026-44023
Fix available
8.6 High
-
docling
Docling: Unsafe URI and Path Handling in HTML Backend
CVE-2026-47214
Fix available
7.1 High
-
docling
Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
CVE-2026-44022
Fix available
5.5 Medium
-
docling, red hat openshift ai 3.4 +1 more
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
CVE-2026-44020
Fix available
7.5 High
-
docling
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
CVE-2026-44018
Fix available
5.5 Medium
-
docling, red hat openshift ai (rhoai) +1 more
Docling: Unsafe Playwright-based HTML Rendering
CVE-2026-44016
Fix available
8.2 High
-
docling, red hat openshift ai 3.4 +1 more
Docling: Unsafe Zip Extraction in EasyOCR Model Download
CVE-2026-44017
Fix available
7.5 High
-
docling docling-core
Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage
CVE-2026-24009
Public exploitFix available
8.1 High