docling-slim vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-105742Lowdocling: Docling: Configured HTTP headers sent to every remote image host named by a documentCVE-2026-105743Mediumdocling: Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)CVE-2026-105744Highdocling: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in…CVE-2026-105748Mediumdocling: Docling: Crafted DoclingDocument JSON embeds local image files into converted outputCVE-2026-105749Mediumdocling: Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustionCVE-2026-105745Mediumdocling: Docling imports plugin entry points before the allow_external_plugins checkCVE-2026-105747Mediumdocling: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)CVE-2026-105750Mediumdocling: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo