High
CVE-2026-107286
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 14
Reset filters
Medium
CVE-2026-107287
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Medium
CVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
High
CVE-2026-107295
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
Low
CVE-2026-107293
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Medium
CVE-2026-107294
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Medium
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Low
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
CVE-2026-107289
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Medium
CVE-2026-54249
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Medium
CVE-2026-48782
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Medium
CVE-2026-46678
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
High
CVE-2026-25640
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
High
CVE-2026-25580
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.