EUVD-2026-118418

GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto,...

CVE-2026-123357

GROBID , a machine learning software for extracting information from scholarly documents, is vulnerable to OS command injection in versions prior to 0.9.1 . The vulnerability exists in the Linux non-server PDF conversion path, specifically within grobid-core/src/main/java/org/grobid/core/document...

EUVD-2026-118414

GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool1, submits ...

CVE-2026-123356

GROBID , a machine learning software for scholarly document information extraction, is vulnerable to a Denial of Service (DoS) condition in versions prior to 0.9.1 . The unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, which...