DO
Product
Docling
16
CVEs
0
On KEV
8.8
Max CVSS
10
New 30D
Severity mix
Critical 0High 9Medium 7Low 0
Watch
Add Docling to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105744 | 8.8 | Oct 5 | Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine Affected: 2.94.0 before 2.132.0 |
| CVE-2026-44016 | 8.2 | Jun 24 | Docling: Unsafe Playwright-based HTML Rendering Affected: 2.82.0 before 2.91.0 |
| CVE-2026-105745 | 7.8 | Oct 5 | Docling: Plugin entry points are imported before the allow_external_plugins check Affected: 2.27.0 before 2.131.0 |
| CVE-2026-105751 | 7.5 | Oct 5 | Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend Affected: 2.107.0 before 2.120.3 |
| CVE-2026-105750 | 7.5 | Oct 5 | Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode Affected: 2.82.0 before 2.118.1 |
| CVE-2026-44017 | 7.5 | Jun 24 | Docling: Unsafe Zip Extraction in EasyOCR Model Download Affected: before 2.91.0 |
| CVE-2026-44020 | 7.5 | Jun 24 | Docling: Unsafe XML Entity Expansion in USPTO Patent Backend Affected: 2.13.0 before 2.74.0 |
| CVE-2026-47214 | 7.1 | Jun 26 | Docling: Unsafe URI and Path Handling in HTML Backend Affected: before 2.94.0 |
| CVE-2026-44018 | 7.1 | Jun 26 | Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend Affected: 2.45.0 before 2.91.0 |
Showing 9