Knowledge Base

In Docling versions prior to 2.94.0 a high severity vulnerability CVE-2026-47214 was detected. This vulnerability may allow an attacker to access unauthorized local files, bypass access restrictions, or potentially perform Server-Side Request Forgery (SSRF) attacks. This occurs due to unsafe URI and path handling within the HTML backend. By supplying a specially crafted URI or file path, an attacker can manipulate the application’s resource resolution mechanisms, forcing the backend to access or process unintended and potentially malicious resources. To address this issue, users should upgrade Docling to version 2.94.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47214.

In affected versions of Gitea a high severity vulnerability CVE-2026-107618 was detected. This vulnerability allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack, resulting in the unauthorized modification of a repository’s topics. This occurs because the POST /{owner}/{repo}/topics endpoint was registered without the necessary sign-in middleware that enforces cross-origin protection. Consequently, if an authenticated repository administrator is tricked into visiting a malicious third-party webpage, the site can forge and send a valid request to alter the repository’s topics without the user’s consent. Note that no other repository settings are reachable or modifiable through this specific route. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-107618.

In Jenkins versions 2.587 and earlier, and LTS 2.580.1 and earlier a low severity vulnerability CVE-2026-117624 was detected. This vulnerability allows an attacker to bypass root element checks and potentially inject unauthorized nested objects. This occurs due to inconsistent enforcement of deserialization restrictions. Specifically, Jenkins fails to correctly restrict the deserialization of object types that are marked as storing their configuration in independent top-level configuration files when they are processed as nested values. By submitting a specially crafted payload, an attacker can evade the intended root element validation and inject malicious nested objects into the system. To address this issue, users should upgrade Jenkins to a patched version (such as 2.588, LTS 2.580.2, or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-117624.

In GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 a critical severity vulnerability CVE-2026-97229 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the GitLab server, potentially leading to a complete system compromise. This occurs due to an integer overflow or wraparound flaw caused by insufficient regular expression validation. By supplying a specially crafted regular expression within a CI/CD configuration, an attacker can trigger this vulnerability and execute unauthorized commands on the underlying server. To address this issue, users should upgrade GitLab CE/EE to versions 19.2.8, 19.3.5, 19.4.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-97229.

In Grafana versions from 11.6.0 before 11.6.15, 12.2.0 before 12.2.9, 12.3.0 before 12.3.7, 12.4.0 before 12.4.4, and 13.0.0 before 13.0.2 a high severity vulnerability CVE-2026-33382 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition by exhausting system memory. This occurs because several Grafana API endpoints—including some that are unauthenticated—do not properly limit the size of the request body before processing it. By sending excessively large payloads, an attacker can force the application into excessive memory allocation, which may exhaust available memory and render the service unresponsive or cause it to crash. To address this issue, users should upgrade Grafana to versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, 13.0.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33382.

In Docling for Python versions from 2.13.0 prior to 2.74.0 a critical severity vulnerability CVE-2026-44020 was detected. This vulnerability allows an attacker to read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks, or cause a Denial of Service (DoS). This occurs due to an XML External Entity (XXE) injection flaw within the USPTO patent backend. The application utilizes the standard xml.sax.parseString() function without adequate protections against XML entity expansion. By supplying a specially crafted USPTO patent XML file containing malicious external entity references, an attacker can exploit three specific format parsers (ICE v4.x, Grant v2.5, and Application v1.x) to access local filesystem data, probe internal networks, or exhaust system resources (e.g., via a Billion Laughs attack). To address this issue, users should upgrade Docling for Python to version 2.74.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44020.