CVE-2026-105746

The Docling document processing library (versions 2.83.0 through 2.131.0 ) contains a flaw where the KServeV2OcrModel class fails to honor the pipeline_options.enable_remote_services setting. This oversight allows the application to transmit page images to configured external endpoints even when ...

CVE-2026-105746 Docling: KServe v2 OCR engine does not enforce enable_remote_services

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kservev2ocrmodel.py sends page images to its configured endpoint without checki...

CVE-2026-105746 Docling: KServe v2 OCR engine does not enforce enable_remote_services

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kservev2ocrmodel.py sends page images to its configured endpoint without checki...

CVE-2026-105744 Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

AZL-106812 CVE-2026-93326 affecting package moby-engine 25.0.3-20

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, fo...

AZL-106815 CVE-2026-93322 affecting package moby-engine 25.0.3-20

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...

AZL-106824 CVE-2026-93323 affecting package moby-engine 25.0.3-20

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...

AZL-106806 CVE-2026-93320 affecting package moby-engine 25.0.3-20

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

AZL-106818 CVE-2026-93318 affecting package moby-engine 25.0.3-20

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

AZL-106809 CVE-2026-93319 affecting package moby-engine 25.0.3-20

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-59782

A flaw was found in Zabbix. An authenticated user with limited administrative privileges can read raw server memory by leveraging the JavaScript preprocessing engine. This flaw leads to information disclosure, exposing sensitive data from other concurrently running preprocessor tasks that should...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in multer

Summary Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in multer. CVE-2026-77037, CVE-2026-77063, CVE-2026-77078, CVE-2026-82333 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-77037 DESCRIPTION: multer is a middleware for handling...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in V8 in Google Chrome prior to version 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption through a crafted script...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, affecting versions 2.7.x before 2.7.17, 2.8.x before 2.8.11, 2.9.x before 2.9.7, as well as Ansible Tower in versions 3.4.5, 3.5.5, and 3.6.3. This issue occurs when using modules that decrypt vault files, such as assemble, script, unarchive, wincopy, awss...

Astra Linux – Vulnerability in Chromium

In V8 of Google Chrome, out-of-bounds memory access before version 141.0.7390.122 allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. In Docker Engine before version 29.5.1, Docker Daemon versions 28.5.2 and earlier, and Moby Daemon before version 2.0.0-beta.14, a race condition during the docker cp mount setup allowed a malicious container to redirect a bind mount target to an...

Astra Linux – Vulnerability in Chromium

The use of after-free in V8 in Google Chrome before version 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...