HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-105745 — Docling simplifies document processing by parsing diverse formats and providing ...

·Source: NIST NVD

Updated:

Executive Summary

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external

Analysis

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0. CVSS Score: 6.7. Published: 2026-10-05T22:16:57.330.

Indicators of Compromise (1)

CVE (1)
CVE-2026-105745
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 5, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-89079 — The Theme My Login plugin for WordPress is vulnerable to privilege escalation vi...

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

CVE-2026-89079
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-103768 — The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is ...

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code executi

CVE-2026-103768
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-109515 — The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, A...

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the

CVE-2026-109515
NIST NVD