12 matches found
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the getInputPath function in the Docling component. An attacker can make Docling fetch attacker-selected URLs or read local files, exposing sensitive data accessible to the Camel process, by sending a String...
CVE-2026-108749
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-108749
A flaw was found in docling-serve. An unauthenticated remote attacker can access sensitive process memory metrics and trigger internal garbage collection routines by querying memory monitoring endpoints that fail to enforce authentication controls. Successful exploitation allows an attacker to...
CVE-2026-108749
A missing authentication vulnerability in docling-serve versions 1.14.0 through 1.36.0 allows unauthenticated remote attackers to access the /v1/memory/stats and /v1/memory/counts endpoints. The root cause is the omission of the require_auth dependency, enabling attackers to bypass the DOCLING_SE...
CVE-2026-108749 docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
EUVD-2026-96914
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
PT-2026-110151
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require auth dependency. Attackers can bypass the configured DOCLING SERVE API KEY to read process and...
CVE-2026-108749: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-55447 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to t...
CVE-2026-55447
Langflow’s BaseFileComponent family (including Read File, DoclingInlineComponent, DoclingServe, DoclingRemoteComponent, NvidiaIngestComponent, VideoFileComponent, UnstructuredComponent) is affected by CVE-2026-55447. The underlying issue is in base_file.py: _unpack_bundle TAR extraction does not ...