EUVD-2026-92814

Docling: enablelocalfetch is not enforced in HTML browser-rendering mode...

CVE-2026-105750

The Docling library (versions 2.82.0 to 2.118.1 ) is vulnerable to a local file disclosure issue when using HTMLBackendOptions(render_page=True). The root cause is that HTMLDocumentBackend._get_browser_request_block_reason fails to enforce the enable_local_fetch setting or restrict local requests...

CVE-2026-105743

The Docling document processing library (versions 2.91.0 through 2.132.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause lies in docling/backend/utils/image_resource_loader.py, where the validate_url_safety function performs only a single IPv4 lookup before allowing the H...