In Docling for Python versions from 2.13.0 prior to 2.74.0 a critical severity vulnerability CVE-2026-44020 was detected. This vulnerability allows an attacker to read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks, or cause a Denial of Service (DoS). This occurs due to an XML External Entity (XXE) injection flaw within the USPTO patent backend. The application utilizes the standard xml.sax.parseString() function without adequate protections against XML entity expansion. By supplying a specially crafted USPTO patent XML file containing malicious external entity references, an attacker can exploit three specific format parsers (ICE v4.x, Grant v2.5, and Application v1.x) to access local filesystem data, probe internal networks, or exhaust system resources (e.g., via a Billion Laughs attack). To address this issue, users should upgrade Docling for Python to version 2.74.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44020.
In Elasticsearch versions from 8.0.0 before 8.19.19, 9.0.0 before 9.3.8, and 9.4.0 before 9.4.4 a medium severity vulnerability CVE-2026-63263 was detected. This vulnerability allows an authenticated attacker to cause a Denial of Service (DoS) condition, rendering the ES|QL engine completely unavailable. This occurs due to an uncontrolled resource consumption flaw within the ES|QL engine. By submitting a specially crafted query, an attacker can trigger exponential CPU consumption during query evaluation. Because this resource exhaustion persists beyond the completion of the query itself, repeated malicious requests will systematically exhaust all available query worker resources. Recovering from this state requires a manual node restart. To address this issue, users should upgrade Elasticsearch to versions 8.19.19, 9.3.8, 9.4.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-63263.
Read more Data Analytics
In Foreman and Red Hat Satellite versions from 6.0 up to and including 6.19 a medium severity vulnerability CVE-2026-13316 was detected. This vulnerability allows an attacker to perform a Server-Side Request Forgery (SSRF) attack and extract sensitive information from cloud metadata services in AWS, GCP, and Azure environments. This occurs due to unvalidated test_url parameters within the Foreman configuration, specifically when HTTP parameters are manipulated in the http_proxies_controller and http_proxy files. By exploiting this flaw, an attacker can force the server to make unauthorized requests to internal network endpoints, compromising the cloud infrastructure’s metadata. To address this issue, users should upgrade Red Hat Satellite to a patched version 6.19.x as soon as it is available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13316.
In Dokploy versions up to and including 0.30.10 a high severity vulnerability CVE-2026-116068 was detected. This vulnerability allows an authenticated attacker, specifically an owner or admin of one organization, to bypass authorization controls and manipulate applications belonging to other tenants. This occurs within the Application tRPC Router, which fails to properly validate the ownership of the supplied applicationId. By providing a foreign applicationId, an attacker can invoke sensitive procedures such as saveEnvironment, updateTraefikConfig, deploy, or stop. This leads to unauthorized actions including the overwriting of environment variables and build secrets, repointing of application sources, and complete disruption of other tenants’ applications. To address this issue, users should apply the specific remediation patch committed in the source code (commit b3cd3c5). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-116068.
In Faraday versions from 1.0.0 before 1.10.6, and 2.0.0 before 2.14.3 a high severity vulnerability CVE-2026-54297 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition through stack exhaustion. This occurs due to an uncontrolled recursion flaw within Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder. Because the library decodes nested query strings without enforcing a maximum nesting depth, an attacker can supply a specially crafted, deeply nested query string. When Faraday builds this into a Ruby Hash structure, the internal dehash routine recursively walks it without a depth limit. At a sufficient depth, this triggers an uncaught SystemStackError (stack level too deep), effectively crashing the calling thread or worker. To address this issue, users should upgrade Faraday to versions 1.10.6, 2.14.3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-54297.
In Elasticsearch versions from 8.0.0 before 8.19.19, 9.0.0 before 9.3.8, and 9.4.0 before 9.4.4 a medium severity vulnerability CVE-2026-63140 was detected. This vulnerability allows a low-privileged authenticated user with read access to at least one index to cause a Denial of Service (DoS). This occurs due to a Reachable Assertion flaw during query parsing. By submitting a specially crafted search request containing a null value in a specific query clause, an attacker can trigger an internal assertion failure. Because Elasticsearch treats assertion failures as fatal errors, the affected node process is immediately terminated. In a single-node deployment, this fully stops the service, while in a multi-node cluster, it reduces overall capacity. To address this issue, users should upgrade Elasticsearch to versions 8.19.19, 9.3.8, 9.4.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-63140.