D
Vendor security profile
docling
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs15
Critical0
CISA KEV0
Public exploit5
Patch rate%93
Avg. CVSS6.1
12-month vulnerability rate
0
0
0
0
0
0
0
4
1
0
0
10
CVE KEV
CVE severity distribution
15toplam CVE
High6 (40%)
Medium7 (47%)
Low2 (13%)
Patch and exploitation view
%93
Verified patch
%0
CISA KEV
%33
Public exploit
14Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
6.3
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
D
Patch status unknown
6.9
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
D
Patch status unknownEPSS %0
5.9
CVE-2026-105750
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
D
Patch verifiedEPSS %0
6.5
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
D
Patch verifiedEPSS %0
4.3
CVE-2026-105748
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
D
Patch verifiedEPSS %0
4.3
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
D
Patch verifiedEPSS %0
2.2
CVE-2026-105746
Docling: KServe v2 OCR engine does not enforce enable_remote_services
D
Patch verifiedEPSS %0
6.7
CVE-2026-105745
Docling: Plugin entry points are imported before the allow_external_plugins check
D
Patch verifiedEPSS %0
7.5
CVE-2026-105744
Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
D
Patch verifiedEPSS %0
4.0
CVE-2026-105743
Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
D
Patch verifiedEPSS %0