Archive
5 October 2026
Vulnerabilities first published on this day (UTC), newest first.
421 results · Feed
-
Medium 6.5
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py,…
-
Medium 5.4
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modificat…
-
Medium 4.3
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized…
-
Medium 4.3
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_ba…
-
Low 2.2
Docling: KServe v2 OCR engine does not enforce enable_remote_services
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images …
-
Critical 9.3
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Sof…
KEV Oct 15, 2026 -
Critical 9.3
openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
-
Medium 6.7
Docling: Plugin entry points are imported before the allow_external_plugins check
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() b…
-
High 7.5
Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/te…
-
Medium 4.0
Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single …
-
Low 3.7
Docling: Configured HTTP headers sent to every remote image host named by a document
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configu…
-
Medium 6.3
dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection
A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in impro…
-
High 7.1
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowe…
-
Critical 9.9CVE-2026-105740 Scanner template
Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command …
-
Medium 4.3
O2OA General url ActionUploadExcelWithUrl server-side request forgery
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to…
-
High 7.0
Canimaan Software ClamXAV local privilege escalation
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privil…
-
High 7.1
Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read…
-
High 7.3CVE-2026-102262 Public exploit
Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim…
-
Medium 4.4
Newell Brands DYMO ID document parsing failing file type extension authentication check
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform…
-
Medium 5.5
Quay: quay: global read-only superuser can access build trigger write credentials
A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can …
-
Medium 6.8
HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates
Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1 SP10, which includes updates to mitigate potential vulnerabilities. Previous versions of HP ThinPro (prior to HP…
-
High 8.1
Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group r…
-
Medium 5.4
Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handle…
-
Medium 6.3
apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root
apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.…
-
Critical 9.9CVE-2026-105697 Public exploit
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c…
-
Medium 6.0
Crafted Git build source can bypass certain policy validation
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy…
-
Medium 6.5
Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An att…
-
Medium 5.9
Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains an…
-
Medium 5.4
Penpot: Stored XSS via Unsanitised SVG Uploads
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as ima…
-
Medium 5.3
Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link …
-
Medium 5.4
Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized infor…
-
Medium 5.4
Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share lin…
-
Critical 9.9
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edi…
-
Medium 5.9
Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and c…
-
Medium 6.0
Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Explo…
-
Medium 6.7
Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the …
-
Medium 4.9
Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's …
-
Low 3.3
Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands
Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 al…
-
Medium 5.3
Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly…
-
Low 3.1
Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP
Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network…