Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,932All CVEsplus 19,141 rejected
- 598Last 24 hours3,195 in the last 7 days
- 17,027Last 30 days1,579 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 6 | 14 | 3 | 0 | 23 | 24 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-114386 | Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_codepydantic · pydantic-ai-harness | Medium6.3 |
| CVE-2026-107295 | `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool executionpydantic · pydantic-ai | High7.6 |
| CVE-2026-107294 | Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlpydantic · pydantic-ai | Medium6.5 |
| CVE-2026-107293 | Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`pydantic · pydantic-ai | Low2.3 |
| CVE-2026-107292 | Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` headerpydantic · pydantic-ai | Medium6.4 |
| CVE-2026-107291 | Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`pydantic · pydantic-ai | Low2.3 |
| CVE-2026-107290 | Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`pydantic · pydantic-ai | Medium6.5 |
| CVE-2026-107289 | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)pydantic · pydantic-ai | Medium6.8 |
| CVE-2026-107288 | Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differentlypydantic · pydantic-ai | Low3.7 |
| CVE-2026-107287 | Pydantic AI: Excessive resource use when local web fetching converts nested HTMLpydantic · pydantic-ai | Medium6.5 |
| CVE-2026-107286 | Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlypydantic · pydantic-ai | High7.5 |
| CVE-2026-84382 | HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)pydantic · httpx2 | High7.5 |
| CVE-2026-84381 | HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxiespydantic · httpx2 | High8.1 |
| CVE-2026-84380 | HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generatedpydantic · httpx2 | Medium5.6 |
| CVE-2026-84379 | HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headersPublic exploitpydantic · httpx2 | Medium5.3 |
| CVE-2026-84378 | HTTPX2: Quadratic SSE line buffering can cause CPU denial of servicepydantic · httpx2 | Medium5.9 |
| CVE-2026-54249 | VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injectionpydantic · pydantic-ai | Medium6.8 |
| CVE-2026-46678 | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)pydantic · pydantic-ai | Medium6.8 |
| CVE-2026-65975 | Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`pydantic · pydantic-ai | Medium6.5 |
| CVE-2026-58203 | NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_sizePublic exploitpydantic · pydantic-settings | Medium5.3 |
| CVE-2026-48782 | pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)pydantic · pydantic-ai | Medium6.8 |
| CVE-2026-25580 | Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handlingpydantic · pydantic-ai | High8.6 |
| CVE-2026-25640 | Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URLpydantic · pydantic-ai | High7.1 |
| CVE-2024-3772 | Regular expression denial of service in Pydantic < 2.4.0Public exploitPydantic · Pydantic | Medium5.9 |