Skip to content
Noroxi

pydantic records

19 published records for vendor pydantic.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
89.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 24
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

19 records
  • CVE-2026-25580
    34Monitor

    Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

    HighCVSS 8.6No exploitEPSS 0%

    pydantic · pydantic aiFeb 6, 2026

  • CVE-2021-29510
    30Monitor

    Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic

    HighCVSS 7.5No exploitEPSS 0%

    pydantic · pydanticMay 13, 2021

  • CVE-2024-3772
    30Monitor

    Regular expression denial of service in Pydantic < 2.4.0

    HighCVSS 7.5No exploitEPSS 0%

    pydantic · pydanticApr 14, 2024

  • CVE-2026-107286
    30Monitor

    Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

    HighCVSS 7.5No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-107295
    30Monitor

    `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

    HighCVSS 7.6No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-48782
    27Monitor

    pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

    MediumCVSS 6.8No exploitEPSS 0%

    pydantic · pydantic aiJun 17, 2026

  • CVE-2026-107289
    27Monitor

    Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

    MediumCVSS 6.8No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-54249
    27Monitor

    VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

    MediumCVSS 6.8No exploitEPSS 0%

    pydantic · pydantic aiJul 29, 2026

  • CVE-2026-107290
    26Monitor

    Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

    MediumCVSS 6.5No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-107294
    26Monitor

    Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

    MediumCVSS 6.5No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-65975
    26Monitor

    Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`

    MediumCVSS 6.5No exploitEPSS 0%

    pydantic · pydantic aiJul 29, 2026

  • CVE-2026-107287
    26Monitor

    Pydantic AI: Excessive resource use when local web fetching converts nested HTML

    MediumCVSS 6.5No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-107292
    25Monitor

    Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

    MediumCVSS 6.4No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-46678
    23Monitor

    Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

    MediumCVSS 5.9No exploitEPSS 0%

    pydantic · pydantic aiJul 29, 2026

  • CVE-2026-25640
    21Monitor

    Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL

    MediumCVSS 5.4No exploitEPSS 0%

    pydantic · pydantic aiFeb 6, 2026

  • CVE-2026-58203
    21Monitor

    NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

    MediumCVSS 5.3No exploitEPSS 0%

    pydantic · pydantic-settingsJul 6, 2026

  • CVE-2026-107288
    14Monitor

    Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

    LowCVSS 3.7No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-107291
    9Monitor

    Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

    LowCVSS 2.3No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026

  • CVE-2026-107293
    9Monitor

    Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

    LowCVSS 2.3No exploitEPSS 0%

    pydantic · pydantic aiOct 8, 2026