Medium
CVE-2026-105750
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-105743
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
High
CVE-2026-105744
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Medium
CVE-2026-105746
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/
Medium
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Medium
CVE-2026-105745
Docling imports plugin entry points before the allow_external_plugins check
Medium
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Low
CVE-2026-105742
Docling: Configured HTTP headers sent to every remote image host named by a document
High
CVE-2026-105701
ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
Medium
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion
Medium
CVE-2026-42700
Image Slider <= 1.1.130 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-39797
The GDPR Framework By Data443 <= 2.5.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39794
WCFM – Multivendor Marketplace REST API for WooCommerce <= 1.6.3 - Missing Authorization
High
CVE-2026-39795
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection
Medium
CVE-2026-39796
Advanced Posts Listing – Show Post List Easily <= 1.0.8 - Missing Authorization
Medium
CVE-2026-39787
10WebSocial <= 1.4.35 - Missing Authorization
Medium
CVE-2026-39788
Front End PM <= 11.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-39791
Mailjet Email Marketing <= 6.2.3 - Unauthenticated Information Exposure
High
CVE-2026-39778
Ansar Import – One Click Starter Sites – for WordPress Themes <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39780
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39781
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39785
Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection
High
CVE-2026-39784
Hotel Booking <= 3.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39773
Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.