PYSEC-2026-4290 Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion t...

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion t...

PYSEC-2026-4208 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

PYSEC-2026-4213 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summarydocling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summarydocling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

SummaryWhen the HTML backend renders pages in a headless browser HTMLBackendOptionsrenderpage=True, the enablelocalfetch option is not enforced. A crafted HTML file can embed an arbitrary local file for example with , and that file's contents appear in the page image attached to the returned...

PYSEC-2026-4215 Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Summary When the HTML backend renders pages in a headless browser HTMLBackendOptionsrenderpage=True, the enablelocalfetch option is not enforced. A crafted HTML file can embed an arbitrary local file for example with , and that file's contents appear in the page image attached to the returned...

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path wheneverthe referenced part is not found inside the document archive. The value comes straight fromcontent.xml, so it is document content, and it is used with no scheme check, no confinement tothe...

PYSEC-2026-4207 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the...

CVE-2026-34008

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-34014

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

CVE-2026-34009

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-34009 **Container Escape** Host user home directory mounted with write access into application container

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-34009 **Container Escape** Host user home directory mounted with write access into application container

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

EUVD-2026-101984

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-34008 **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-98404

A flaw was found in the Linux kernel's VirtIO GPU driver. A local user could exploit this flaw to cause a Denial of Service DoS by triggering a system crash. When user framebuffer creation encounters an error, the driver improperly returns a null value instead of an error code, resulting in a nul...

CVE-2026-34014 ds-move-files.sh is writable and executed as root

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...