CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,499 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,499
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product pydantic:pydantic_ai. Show all products

16 CVEs, showing 1 to 16
CVESeverityTitlePublished
CVE-2026-25640Medium 5.4Pydantic AI is a Python agent framework for building applications and workflows with Generative AI.Feb 6, 2026
CVE-2026-25580High 8.6Pydantic AI is a Python agent framework for building applications and workflows with Generative AI.Feb 6, 2026
CVE-2026-48782Medium 6.8Pydantic AI is a Python agent framework for building applications and workflows with Generative AI.Jun 17, 2026
CVE-2026-46678Medium 5.9Pydantic AI is a Python agent framework for building Generative AI applications.Jul 29, 2026
CVE-2026-54249Medium 6.8Pydantic AI is a Python agent framework for building Generative AI applications.Jul 29, 2026
CVE-2026-65975Medium 6.5Pydantic AI is a Python agent framework for building applications and workflows with Generative AI.Jul 29, 2026
CVE-2026-107286High 7.5Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107287Medium 6.5Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107288Low 3.7Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107289Medium 6.8Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107290Medium 6.5Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107291Low 2.3Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107292Medium 6.4Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107293Low 2.3Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107294Medium 6.5Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Assigned by GitHub_M
Oct 8, 2026
CVE-2026-107295High 7.6`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution
Assigned by GitHub_M
Oct 8, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.