Advisories

Docling versions 2.107.0 through 2.120.3 are affected by CVE-2026-105751 in docling/backend/opendocument_backend.py. When an xlink:href value on a draw:image element points to a part missing from the archive, the _image_ref_from_odf_image function reads it as a filesystem path with no scheme check, no extraction-directory confinement, and no enable_local_fetch check. Readable image files are embedded in converted output, and other paths can be told apart through the read attempt.

Docling, a document processing library, versions 2.82.0 through 2.118.1 are affected by CVE-2026-105750. When HTMLBackendOptions(render_page=True) is used with Playwright installed, HTMLDocumentBackend._get_browser_request_block_reason fails to enforce enable_local_fetch or confine local requests to the source document directory, so file URLs are permitted. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image. Only filesystem Path inputs are affected; stream inputs, the default configuration, the command-line interface, docling-serve, and non-rendering backends are not.

Docling, a document-parsing library with generative AI integrations, has a resource exhaustion flaw in its HTML, JATS, OpenDocument spreadsheet, and BoxNote backends (docling/backend/html_backend.py, docling/backend/jats_backend.py, docling/backend/boxnote_backend.py) in versions 2.0.0 through 2.131.0. These backends accept unbounded rowspan and colspan values and allocate a table grid proportional to the declared span, so a very small document can cause sustained CPU use or multi-gigabyte memory allocation. The document_timeout setting does not interrupt the single backend conversion call, and exporting through TableData.grid can materialize the oversized grid.

Docling versions 2.16.0 through 2.131.0 contain a flaw in the InputFormat.JSON_DOCLING backend (docling/backend/json/docling_json_backend.py). It accepts serialized DoclingDocument input without rejecting picture image references that point to local paths or file URIs. When the document is exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods open those references, so readable image bytes can appear in Markdown or HTML output, limited to files Pillow can decode as images. Differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this fix.

Docling, a document processing library, versions 2.45.0 through 2.131.0, calls tarfile.TarFile.getmembers() in METS-GBS format detection (docling/datamodel/document.py) and in docling/backend/mets_gbs_backend.py before max_member_count is enforced. A small gzip-compressed tar with a very large number of empty members can therefore consume memory proportional to its declared member count, including during format detection before allowed_formats is applied. This is a residual weakness in the protection added for CVE-2026-44018.

Docling, a document processing library, runs plugin factories in docling/models/factories/base_factory.py that call load_setuptools_entrypoints() before checking allow_external_plugins. From 2.27.0 until 2.131.0, every module in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore run import-time code when Docling starts, and the namespace filter wrongly reports that the plugin was not loaded.

Docling, from 2.91.0 through 2.132.0, has a flaw in validate_url_safety (docling/backend/utils/image_resource_loader.py). It checks a hostname with a single IPv4 lookup, then lets the HTTP client resolve the original URL again, which allows DNS rebinding and mixed public and internal address records to reach internal services. HTMLBackendOptions(render_page=True) also permits HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when decoded as an image or passively rendered in a page screenshot.

Langflow versions 1.0.0 through 1.10.1 did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach them; from 1.7.2 through 1.10.0, any authenticated caller without elevated privileges could. The caller could load and cache a private graph, enumerate its vertices, and execute selected vertices to receive their results, disclosing flow structure, configured values and outputs, and triggering victim-configured side effects. Variable-store credentials could not be exposed and the stored flow could not be modified.

CVE-2026-104247 affects vtcode versions below 0.171.5. An empty ANSI-C quote spliced into a find flag (for example -exe$''c) bypasses the is_destructive_find_option check, so the command is still treated as a safe find. Once the agent has learned that find family from three prior approvals, prompt_tool_permission auto-approves it and the shell runs it as the user running VTCode, with no new prompt. Exploitation requires a local session, those prior approvals, and something that can steer the agent, such as indirect prompt injection.

A vulnerability has been found in Weaviate Verba up to 2.1.3. The function get_environment in goldenverba/components/util.py, reached through the generate_stream Endpoint component, can be manipulated to disclose information. The attack can be launched remotely, and the exploit is public. The vendor was contacted early but did not respond.

The SupportCandy AI Customer Support Ticket System and Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL injection through the 'sort_by' parameter in all versions up to and including 3.5.3. The flaw stems from insufficient escaping of user-supplied input and a SQL query that is not sufficiently prepared. An authenticated attacker can append SQL queries to existing ones and extract sensitive information from the database. Exploitation requires a Subscriber-level or higher WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission.

CVE-2026-94378 affects the SupportCandy AI Customer Support Ticket System and Live Chatbot Agent plugin for WordPress in all versions up to and including 3.5.3. The 'name' parameter lacks sufficient input sanitization and output escaping, enabling Stored Cross-Site Scripting. An authenticated attacker with subscriber-level access or above can inject web scripts that execute whenever a user views an injected page. The exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.