CVE Tools
Track your stack

Docling

10 CVEs tracked since 2026. Since Oct 2026, none of them reached CISA KEV.

Docling CVEs per month

Oct 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Docling CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-10100

Products

The products that kept showing up in Docling's monthly top three, with their CVEs summed over those months.

  1. Docling101 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Docling.

  1. CVE-2026-105751Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend7.5
  2. CVE-2026-105750Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode5.9
  3. CVE-2026-105749Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion6.5
  4. CVE-2026-105748Docling: Crafted DoclingDocument JSON embeds local image files into converted output4.3
  5. CVE-2026-105747Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)4.3
  6. CVE-2026-105746Docling: KServe v2 OCR engine does not enforce enable_remote_services2.2
  7. CVE-2026-105745Docling: Plugin entry points are imported before the allow_external_plugins check6.7
  8. CVE-2026-105744Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine7.5
  9. CVE-2026-105743Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)4.0
  10. CVE-2026-105742Docling: Configured HTTP headers sent to every remote image host named by a document3.7
  11. CVE-2026-44023Docling Core has unsafe remote filename resolution8.6
  12. CVE-2026-47214Docling: Unsafe URI and Path Handling in HTML Backend7.1
  13. CVE-2026-44018Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend5.5
  14. CVE-2026-44017Docling: Unsafe Zip Extraction in EasyOCR Model Download7.5
  15. CVE-2026-44022Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands5.5

The record

Peak rank
#155 in Oct 2026
Busiest month shown
Oct 2026, 10 CVEs
Months with a KEV entry
0 since Oct 2026
Monthly snapshots
1 since 2026
Docling's full record, month by month