Data Management and Analytics

In Elasticsearch versions up to 8.19.16/9.3.5/9.4.2 a medium severity vulnerability CVE-2026-56149 was detected. This vulnerability allows an authenticated user with elevated privileges to cause a Denial of Service (DoS) by rendering the affected node unavailable. This occurs due to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw in the processing of machine learning requests. By submitting a specially crafted machine learning request, an attacker can trigger excessive memory allocation (CAPEC-130), leading to resource exhaustion and the subsequent unavailability of the Elasticsearch node. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56149.

In Docling versions 2.45.0 to before 2.91.0 a medium severity vulnerability CVE-2026-44018 was detected. This vulnerability allows an attacker to read sensitive files, exhaust system resources, or cause application crashes, leading to unauthorized information disclosure and Denial of Service (DoS). This occurs due to unsafe archive extraction and a lack of security controls during XML parsing in the METS-GBS backend. By crafting a malicious METS-GBS archive and exploiting the input document format detection mechanisms (such as via XML External Entity (XXE) injection or archive bombs), an attacker can compromise the parsing process. To address this issue, users should upgrade Docling to version 2.91.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44018.

In Docling versions prior to 2.91.0 a high severity vulnerability CVE-2026-44017 was detected. This vulnerability allows an attacker to write arbitrary files to any location writable by the process, potentially leading to Remote Code Execution (RCE) or persistent backdoors. This occurs due to a Zip Slip flaw in the EasyOCR model download functionality, where ZIP archives are extracted without properly validating member paths. If an attacker successfully compromises the model download source—such as through a supply chain attack, DNS spoofing, or a Man-in-the-Middle (MITM) attack—they can deliver a maliciously crafted ZIP file containing directory traversal sequences. To address this issue, users should upgrade Docling to version 2.91.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44017.

In Docling versions 2.73.0 to before 2.91.0 a medium severity vulnerability CVE-2026-44022 was detected. This vulnerability allows an attacker to read arbitrary files from the local file system, potentially exposing configuration files, credentials, and other sensitive data. This occurs due to a path traversal flaw in the LaTeX backend’s handling of the \includegraphics, \input, and \include commands, which lacked proper path containment validation. By crafting a malicious LaTeX document with directory traversal sequences, an attacker can force the system to include sensitive files directly into the converted document output. To address this issue, users should upgrade Docling to version 2.91.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44022.

In GeoServer DB2 DataStore Extension versions prior to 2.27.0 a high severity vulnerability CVE-2025-27511 was detected. This vulnerability allows an authenticated administrator to achieve Remote Code Execution (RCE) on the server. This occurs because the extension is vulnerable to a JNDI injection attack when processing a specially crafted DB2 JDBC URL. To address this issue, users should upgrade the GeoServer DB2 DataStore Extension to version 2.27.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27511.

In NocoDB versions prior to 2026.05.1 a medium severity vulnerability CVE-2026-53928 was detected. This vulnerability allows an attacker in possession of a stolen refresh token to maintain unauthorized access by minting new JSON Web Tokens (JWTs), even after the victim has completed a password recovery flow. This occurs because the passwordForgot process fails to delete the user’s active refresh tokens—unlike standard password change or reset flows—leaving them valid for exchange. To address this issue, users should upgrade NocoDB to version 2026.05.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53928.

In vLLM versions 0.10.2 to before 0.13.0 a high severity vulnerability CVE-2026-56340 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) through crashes or resource exhaustion, with the potential for out-of-bounds memory corruption. This occurs because the multimodal embeddings processing lacks proper sparse tensor validation. When the prompt-embeds feature is enabled, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices. Because PyTorch disables sparse tensor invariant checks by default, these malicious tensors bypass validation. This flaw is a continuation of CVE-2025-62164, where the initial fix only disabled the feature by default instead of addressing the root cause. To address this issue, users should upgrade vLLM to version 0.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56340.

In MongoDB Server versions 8.3.0 through 8.3.3, 8.2.0 through 8.2.10, 8.0.0 through 8.0.25, 7.0.0 through 7.0.36, 6.0.0 through 6.0.28, 5.0.0 through 5.0.33, 4.4.0 through 4.4.30 a high severity vulnerability CVE-2026-11933 was detected. This vulnerability allows an authenticated user with read privileges to cause a Denial of Service (DoS) or disclose sensitive information from the mongod process memory. This occurs due to a Use-After-Free (UAF) flaw in the server-side JavaScript engine when converting BSON documents to JavaScript arrays. By executing server-side JavaScript (for example, via the $where or $function operators), an attacker can trigger the server to access memory that has already been freed. To address this issue, users should upgrade MongoDB Server to a patched version 8.3.x, 8.2.11, or 8.0.26 (or later), 7.0.37 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11933.

In MariaDB Server versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 a medium severity vulnerability CVE-2026-44169 was detected. This vulnerability allows an authenticated user to gain unauthorized visibility into stored routine definitions, leading to information disclosure. This occurs because if a user is granted EXECUTE access to a stored routine via a role, the system improperly permits them to see the routine’s definition, even if they lack the explicitly required SHOW CREATE ROUTINE privilege. To address this issue, users should upgrade MariaDB Server to versions 11.4.11, 11.8.7, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44169.