CVE-2026-47214

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-73CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-472154.8SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incoCVE-2026-472168.7Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is an unauthenticated denial-of-service vulnerabiliCVE-2026-472189.3runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime prCVE-2026-472197.5find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions pCVE-2026-47228.8Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.CVE-2026-472207.5Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESCVE-2026-472217.5Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3CVE-2026-472225.4NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap outCVE-2026-472235.4NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap outCVE-2026-472244.3NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap bufCVE-2026-472256.0Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affecting search requestCVE-2026-472266.5Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one f
CVE-2026-47214: High severity, CVSS 7.1 | Vulnix