Data Management and Analytics

In Grafana versions from 11.6.0 before 11.6.15, 12.2.0 before 12.2.9, 12.3.0 before 12.3.7, 12.4.0 before 12.4.4, and 13.0.0 before 13.0.2 a high severity vulnerability CVE-2026-33382 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition by exhausting system memory. This occurs because several Grafana API endpoints—including some that are unauthenticated—do not properly limit the size of the request body before processing it. By sending excessively large payloads, an attacker can force the application into excessive memory allocation, which may exhaust available memory and render the service unresponsive or cause it to crash. To address this issue, users should upgrade Grafana to versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, 13.0.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33382.

In Docling versions prior to 2.94.0 a high severity vulnerability CVE-2026-47214 was detected. This vulnerability may allow an attacker to access unauthorized local files, bypass access restrictions, or potentially perform Server-Side Request Forgery (SSRF) attacks. This occurs due to unsafe URI and path handling within the HTML backend. By supplying a specially crafted URI or file path, an attacker can manipulate the application’s resource resolution mechanisms, forcing the backend to access or process unintended and potentially malicious resources. To address this issue, users should upgrade Docling to version 2.94.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47214.

In Docling for Python versions from 2.13.0 prior to 2.74.0 a critical severity vulnerability CVE-2026-44020 was detected. This vulnerability allows an attacker to read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks, or cause a Denial of Service (DoS). This occurs due to an XML External Entity (XXE) injection flaw within the USPTO patent backend. The application utilizes the standard xml.sax.parseString() function without adequate protections against XML entity expansion. By supplying a specially crafted USPTO patent XML file containing malicious external entity references, an attacker can exploit three specific format parsers (ICE v4.x, Grant v2.5, and Application v1.x) to access local filesystem data, probe internal networks, or exhaust system resources (e.g., via a Billion Laughs attack). To address this issue, users should upgrade Docling for Python to version 2.74.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44020.

In Elasticsearch versions from 8.0.0 before 8.19.19, 9.0.0 before 9.3.8, and 9.4.0 before 9.4.4 a medium severity vulnerability CVE-2026-63263 was detected. This vulnerability allows an authenticated attacker to cause a Denial of Service (DoS) condition, rendering the ES|QL engine completely unavailable. This occurs due to an uncontrolled resource consumption flaw within the ES|QL engine. By submitting a specially crafted query, an attacker can trigger exponential CPU consumption during query evaluation. Because this resource exhaustion persists beyond the completion of the query itself, repeated malicious requests will systematically exhaust all available query worker resources. Recovering from this state requires a manual node restart. To address this issue, users should upgrade Elasticsearch to versions 8.19.19, 9.3.8, 9.4.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-63263.

In Elasticsearch versions from 8.0.0 before 8.19.17, 9.0.0 before 9.3.6, and 9.4.0 before 9.4.3 a medium severity vulnerability CVE-2026-56148 was detected. This vulnerability allows an authenticated attacker to cause a Denial of Service (DoS) condition on the affected node. This occurs due to an Uncontrolled Recursion flaw triggered during query processing. By submitting a specially crafted query, an attacker can force the system into excessive resource allocation, quickly exhausting available resources and rendering the node completely unavailable. To address this issue, users should upgrade Elasticsearch to versions 8.19.17, 9.3.6, 9.4.3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56148.

In Elasticsearch versions from 8.0.0 before 8.19.19, 9.0.0 before 9.3.8, and 9.4.0 before 9.4.4 a medium severity vulnerability CVE-2026-63140 was detected. This vulnerability allows a low-privileged authenticated user with read access to at least one index to cause a Denial of Service (DoS). This occurs due to a Reachable Assertion flaw during query parsing. By submitting a specially crafted search request containing a null value in a specific query clause, an attacker can trigger an internal assertion failure. Because Elasticsearch treats assertion failures as fatal errors, the affected node process is immediately terminated. In a single-node deployment, this fully stops the service, while in a multi-node cluster, it reduces overall capacity. To address this issue, users should upgrade Elasticsearch to versions 8.19.19, 9.3.8, 9.4.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-63140.

In Elasticsearch versions from 8.0.0 before 8.19.15, 9.0.0 before 9.2.9, and 9.3.0 before 9.3.4 a medium severity vulnerability CVE-2026-63136 was detected. This vulnerability allows an authenticated user with search privileges to cause a Denial of Service (DoS) condition through heap memory exhaustion. This occurs due to an uncontrolled resource consumption flaw. By submitting a specially crafted search request, an attacker can force a data node to excessively allocate and exhaust all available heap memory. This leads to immediate node unavailability, severe cluster degradation, and potential cluster downtime that requires manual intervention to restore service. To address this issue, users should upgrade Elasticsearch to versions 8.19.15, 9.2.9, 9.3.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-63136.

In Docling versions from 2.82.0 prior to 2.91.0 a high severity vulnerability CVE-2026-44016 was detected. This vulnerability allows an attacker to execute arbitrary JavaScript, perform Server-Side Request Forgery (SSRF) attacks, exfiltrate data, or potentially achieve Remote Code Execution (RCE) within the rendering environment. This occurs when the Playwright-based HTML backend is explicitly configured for rendering (a feature that is deactivated by default). By supplying an untrusted, specially crafted HTML document, an attacker can force the application to execute malicious scripts that make unauthorized network requests to internal services. To address this issue, users should upgrade Docling to version 2.91.0 or later, or ensure the HTML rendering feature remains disabled. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44016.

In Docling versions from 2.107.0 before 2.120.3 a high severity vulnerability CVE-2026-105751 was detected. This vulnerability allows an attacker to read arbitrary local files and embed them into the converted output, leading to unauthorized information disclosure. This occurs due to a flaw in the docling/backend/opendocument_backend.py module, where the _image_ref_from_odf_image function uses the xlink:href attribute of a draw:image element as a direct filesystem path without proper sanitization, scheme checks, or extraction-directory confinement. If the referenced part is not found in the OpenDocument archive, the backend attempts to fetch it locally, completely ignoring the enable_local_fetch safety setting used by other backends. Files that can be decoded as images by Pillow are embedded directly in the output, while other existing file paths can be probed and distinguished through the attempted read. To address this issue, users should upgrade Docling to version 2.120.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-105751.