docling-project docling

• CVE-2026-105751 Medium 6.9 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend 0.4%
• CVE-2026-105750 Medium 5.9 Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode 0.4%
• CVE-2026-105749 Medium 6.5 Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion 0.3%
• CVE-2026-105748 Medium 4.3 Docling: Crafted DoclingDocument JSON embeds local image files into converted output 0.3%
• CVE-2026-105747 Medium 4.3 Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) 0.3%
• CVE-2026-105746 Low 2.2 Docling: KServe v2 OCR engine does not enforce enable_remote_services 0.2%
• CVE-2026-105745 Medium 6.7 Docling: Plugin entry points are imported before the allow_external_plugins check 0.1%
• CVE-2026-105744 High 7.5 Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine 0.4%
• CVE-2026-105743 Medium 4.0 Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) 0.2%
• CVE-2026-105742 Low 3.7 Docling: Configured HTTP headers sent to every remote image host named by a document 0.3%
• CVE-2026-47214 High 7.1 Docling: Unsafe URI and Path Handling in HTML Backend 0.4%
• CVE-2026-44018 Medium 5.5 Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend 0.2%
• CVE-2026-44017 High 7.5 Docling: Unsafe Zip Extraction in EasyOCR Model Download 0.7%
• CVE-2026-44022 Medium 5.5 Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands 0.2%
• CVE-2026-44020 High 7.5 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend 0.6%
• CVE-2026-44016 High 8.2 Docling: Unsafe Playwright-based HTML Rendering 0.6%