CVE-2026-105742

A flaw was found in docling. This vulnerability can lead to information disclosure of sensitive credentials, such as API keys and session tokens. When remote image fetching is enabled, the HTML image loader fails to restrict custom request headers to the document's original domain. A remote...

CVE-2026-105750

A flaw was found in docling. This vulnerability can lead to information disclosure when HTML page rendering is enabled. The document rendering backend fails to enforce local file access restrictions or confine requests to the source document directory. An attacker could exploit this issue by...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Click Arbitrary Code Execution Vulnerability. CVE-2022-21241 ⚠ This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks. Vulnerability The following versions are vulnerable. CSV+ click me 👻...

nullscan

Descripción Un marco modular diseñado para encadenar y automatizar pruebas de seguridad. Analiza definiciones de objetivos desde la línea de comandos y ejecuta los módulos correspondientes y sus herramientas nullscan después. También puede tomar hosts e iniciar nmap primero para realizar un escan...

nullscan

Description A modular framework designed to chain and automate security tests. It parses target definitions from the command line and runs corresponding modules and their nullscan-tools afterwards. It can also take hosts and start nmap first in order to perform a basic portscan and run the module...

https-nj.gov---CVE-2020-11022

https-nj.gov---CVE-2020-11022 Vulnearability Report of the New Jersey official site Potential XSS vulnerability in jQuery.htmlPrefilter and related methods. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

domato

Domato 🍅 Un fuzzer de DOM Escrito y mantenido por Ivan Fratric, [email protected] Copyright 2017 Google Inc. Todos los derechos reservados. Licenciado bajo la Apache License, Versión 2.0 la "Licencia"; no puede utilizar este archivo excepto en cumplimiento de la Licencia. Puede obtener una...

CVE-2026-105750 Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptionsrenderpage=True permits file URLs because HTMLDocumentBackend.getbrowserrequestblockreason does not enforce the...

CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 Una herramienta rápida para obtener URLs de atributos HTML mediante rastreo. Inspirada en el tweet de @omespino, que permite extraer valores src, href, url y action evaluando JavaScript a través del Protocolo Chrome DevTools. Recursos...

CVE-2026-105742

The Docling library (versions 2.95.0 to 2.132.0) contains a vulnerability in the HTML image resource loader located at docling/backend/utils/image_resource_loader.py. When enable_remote_fetch and fetch_images are both set to True, the loader forwards headers configured via HTMLBackendOptions.head...

CVE-2006-3392

CVE-2006-3392 Description Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are...

prometheus

Installing Prometheus Prometheus is a Ruby application and will run on any system running a recent version 1.8.7 or higher of Ruby. To install Prometheus use the following steps: 1. Create a directory called prometheus. 2. Extract the prometheus files into the directory. 3. CD into the prometheus...

CVE-2026-103629

A flaw was found in the Skia graphics library in chromium-browser. This vulnerability allows for information disclosure through an integer overflow when processing web content. A remote attacker can exploit this flaw by enticing a user to view a specially crafted HTML page, leading to unauthorize...

CVE-2026-100791

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-100774

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-105651

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...