CLEANSTART-2026-QM27713 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

Security vulnerability affects the ollama-fips package. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component...

CVE-2026-107289

A flaw was found in pydantic-ai. This vulnerability can lead to information disclosure, potentially exposing sensitive cloud credentials such as Identity and Access Management IAM tokens. In configurations where local network access is permitted for untrusted requests, a remote attacker can bypas...

bind: BIND: Denial of Service via crafted DNSSEC reply

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...

GHSA-VMXC-H2X2-JMF3 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

Improper Validation of Unsafe Equivalence in Input

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via IPv6 zone identifier handling in the ssrf.py SSRF guard functions iscloudmetadataip and...

Improper Validation of Unsafe Equivalence in Input

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via IPv6 zone identifier handling in the ssrf.py SSRF guard functions iscloudmetadataip and isprivateip. An attacker can supply an...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

bind: BIND: Denial of Service via crafted DNSSEC reply

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289

The Pydantic AI Python agent framework is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.56.0 through 1.107.5 and 2.44.0. When users opt-in to local network access via FileUrl (with force_download='allow-local') or web_fetch_tool (with allow_local_urls=True), an attacker can bypas...

CVE-2026-5049

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

CVE-2026-5049

A path traversal vulnerability exists in the Zone Alias Import flow feature of the HPE B-Series SANnav Management Portal (prior to versions 3.0.0a and 3.0.1 ) and Brocade SANnav (before 3.0.0a ). A local authenticated attacker can exploit this flaw to write uploaded content outside the intended d...

EUVD-2026-94758

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

CVE-2026-87666

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

CVE-2026-87666

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are vulnerable to an OS command injection in the time and zone management subsystem. The root cause is a failure to sanitize input values when updating system timezone settings via the REST API or configuration download routines...

EUVD-2026-94694

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

CVE-2026-87666: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

PT-2026-107826

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...