https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-107295.htmlhttps://patchthecve.com/cve/CVE-2026-107295.htmlTue, 13 Oct 2026 14:16:53 +0000HIGH 7.6: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compahttps://patchthecve.com/cve/CVE-2026-107294.htmlhttps://patchthecve.com/cve/CVE-2026-107294.htmlTue, 13 Oct 2026 13:49:02 +0000MEDIUM 6.5: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An https://patchthecve.com/cve/CVE-2026-107293.htmlhttps://patchthecve.com/cve/CVE-2026-107293.htmlTue, 13 Oct 2026 14:30:39 +0000MEDIUM 5.3: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages ahttps://patchthecve.com/cve/CVE-2026-107292.htmlhttps://patchthecve.com/cve/CVE-2026-107292.htmlWed, 14 Oct 2026 01:17:05 +0000MEDIUM 6.4: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-https://patchthecve.com/cve/CVE-2026-107291.htmlhttps://patchthecve.com/cve/CVE-2026-107291.htmlTue, 13 Oct 2026 14:34:22 +0000MEDIUM 4.3: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message andhttps://patchthecve.com/cve/CVE-2026-107290.htmlhttps://patchthecve.com/cve/CVE-2026-107290.htmlTue, 13 Oct 2026 14:34:38 +0000MEDIUM 6.5: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and orderehttps://patchthecve.com/cve/CVE-2026-107289.htmlhttps://patchthecve.com/cve/CVE-2026-107289.htmlTue, 13 Oct 2026 14:34:48 +0000MEDIUM 6.8: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urlshttps://patchthecve.com/cve/CVE-2026-107288.htmlhttps://patchthecve.com/cve/CVE-2026-107288.htmlTue, 13 Oct 2026 14:35:05 +0000LOW 3.7: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used byhttps://patchthecve.com/cve/CVE-2026-107287.htmlhttps://patchthecve.com/cve/CVE-2026-107287.htmlWed, 14 Oct 2026 01:17:04 +0000MEDIUM 6.5: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML contahttps://patchthecve.com/cve/CVE-2026-107286.htmlhttps://patchthecve.com/cve/CVE-2026-107286.htmlTue, 13 Oct 2026 14:36:51 +0000HIGH 7.5: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slo