CVE Tools
Track your stack

Docling-project

11 CVEs tracked since 2026. Since Oct 2026, none of them reached CISA KEV.

Docling-project CVEs per month

Oct 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Docling-project CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-10110

Products

The products that kept showing up in Docling-project's monthly top three, with their CVEs summed over those months.

  1. Docling101 month
  2. Docling-slim91 month
  3. Docling-core11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Docling-project.

  1. CVE-2026-112310docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef4.3
  2. CVE-2026-105751Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend7.5
  3. CVE-2026-105750Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode5.9
  4. CVE-2026-105749Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion6.5
  5. CVE-2026-105748Docling: Crafted DoclingDocument JSON embeds local image files into converted output4.3
  6. CVE-2026-105747Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)4.3
  7. CVE-2026-105746Docling: KServe v2 OCR engine does not enforce enable_remote_services2.2
  8. CVE-2026-105745Docling: Plugin entry points are imported before the allow_external_plugins check6.7
  9. CVE-2026-105744Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine7.5
  10. CVE-2026-105743Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)4.0
  11. CVE-2026-105742Docling: Configured HTTP headers sent to every remote image host named by a document3.7
  12. CVE-2026-44023Docling Core has unsafe remote filename resolution8.6
  13. CVE-2026-44019Docling Core has insufficient validation of image reference URIs8.1
  14. CVE-2026-47214Docling: Unsafe URI and Path Handling in HTML Backend7.1
  15. CVE-2026-44018Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend5.5

The record

Peak rank
#138 in Oct 2026
Busiest month shown
Oct 2026, 11 CVEs
Months with a KEV entry
0 since Oct 2026
Monthly snapshots
1 since 2026
Docling-project's full record, month by month