DO
Vendor
docling-project
29
CVEs
0
On KEV
20
New 30D
Products
DO8.8
docling
docling-project
16 CVEs0 on KEV10 new
DO8.8
docling-slim
docling-project
9 CVEs0 on KEV9 new
DO8.6
docling-core
docling-project
3 CVEs0 on KEV1 new
DO5.7
docling-graph
docling-project
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112310 | DO docling-core docling-project | 4.3 | Oct 19 | docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef |
| CVE-2026-105751 | DO docling docling-project | 7.5 | Oct 5 | Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend |
| CVE-2026-105750 | DO docling-slim docling-project | 7.5 | Oct 5 | Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode |
| CVE-2026-105749 | DO docling-slim docling-project | 6.5 | Oct 5 | Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion |
| CVE-2026-105748 | DO docling docling-project | 4.3 | Oct 5 | Docling: Crafted DoclingDocument JSON embeds local image files into converted output |
| CVE-2026-105747 | DO docling docling-project | 4.3 | Oct 5 | Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) |
| CVE-2026-105746 | DO docling docling-project | 5.3 | Oct 5 | Docling: KServe v2 OCR engine does not enforce enable_remote_services |
| CVE-2026-105745 | DO docling docling-project | 7.8 | Oct 5 | Docling: Plugin entry points are imported before the allow_external_plugins check |
| CVE-2026-105744 | DO docling docling-project | 8.8 | Oct 5 | Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine |
| CVE-2026-105743 | DO docling docling-project | 5.8 | Oct 5 | Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) |
| CVE-2026-105742 | DO docling docling-project | 5.3 | Oct 5 | Docling: Configured HTTP headers sent to every remote image host named by a document |
| CVE-2026-44023 | DO docling-core docling-project | 8.6 | Jul 16 | Docling Core has unsafe remote filename resolution |
| CVE-2026-44019 | DO docling-core docling-project | 8.1 | Jul 16 | Docling Core has insufficient validation of image reference URIs |
| CVE-2026-47214 | DO docling docling-project | 7.1 | Jun 26 | Docling: Unsafe URI and Path Handling in HTML Backend |
| CVE-2026-44018 | DO docling docling-project | 7.1 | Jun 26 | Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend |
| CVE-2026-44017 | DO docling docling-project | 7.5 | Jun 24 | Docling: Unsafe Zip Extraction in EasyOCR Model Download |
| CVE-2026-44022 | DO docling docling-project | 5.5 | Jun 24 | Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands |
| CVE-2026-44020 | DO docling docling-project | 7.5 | Jun 24 | Docling: Unsafe XML Entity Expansion in USPTO Patent Backend |
| CVE-2026-44016 | DO docling docling-project | 8.2 | Jun 24 | Docling: Unsafe Playwright-based HTML Rendering |
| CVE-2026-44520 | DO docling-graph docling-project | 5.7 | May 14 | Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler |