CVE Tools
Track your stack

Pydantic

10 CVEs tracked since 2026. Since Oct 2026, none of them reached CISA KEV.

Pydantic CVEs per month

Oct 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Pydantic CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-10100

Products

The products that kept showing up in Pydantic's monthly top three, with their CVEs summed over those months.

  1. Pydantic AI101 month
  2. Pydantic-ai101 month
  3. Pydantic-ai-slim101 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Pydantic.

  1. CVE-2026-114386Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code4.8
  2. CVE-2026-107295`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution7.6
  3. CVE-2026-107294Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl6.5
  4. CVE-2026-107293Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`5.3
  5. CVE-2026-107292Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header6.4
  6. CVE-2026-107291Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`4.3
  7. CVE-2026-107290Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`6.5
  8. CVE-2026-107289Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)6.8
  9. CVE-2026-107288Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently3.7
  10. CVE-2026-107287Pydantic AI: Excessive resource use when local web fetching converts nested HTML6.5
  11. CVE-2026-107286Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early7.5
  12. CVE-2026-84382HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)7.5
  13. CVE-2026-84381HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies8.1
  14. CVE-2026-84380HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated5.6
  15. CVE-2026-84379HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers5.3

The record

Peak rank
#120 in Oct 2026
Busiest month shown
Oct 2026, 10 CVEs
Months with a KEV entry
0 since Oct 2026
Monthly snapshots
1 since 2026
Pydantic's full record, month by month