HIGH8.8PyPI
GHSA-4hh5-2678-83fx· CVE-2023-6022, PYSEC-2026-1799Cross-Site Request Forgery vulnerability in Prefect
Modified: 9/10/2026
package
PyPI/prefect
pkg:pypi/prefect
HIGH7.6PyPI
GHSA-4v9f-r55g-g6hc· CVE-2024-8183, PYSEC-2026-1800Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
Modified: 7/7/2026
MEDIUM6.3PyPI
GHSA-6rcx-55r6-jx65· CVE-2026-7725, PYSEC-2026-2955Prefect Git Argument Injection in GitRepository Pull Steps
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-6rr6-v7cj-mxpg· CVE-2026-7722, PYSEC-2026-2956Prefect Auth Bypass via endswith() Health Check Exemption
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-c635-393c-hcx2· CVE-2026-3514, PYSEC-2026-2261Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'
Modified: 9/10/2026
HIGH8.5PyPI
GHSA-cw25-2p92-7f75· CVE-2026-3515, PYSEC-2026-2957Prefect has an Argument Injection issue
Modified: 9/10/2026
HIGH7.3PyPI
GHSA-hvph-5985-r63v· CVE-2026-7723, PYSEC-2026-2958Prefect Unauthenticated Event Injection via /api/events/in WebSocket
Modified: 9/10/2026
MEDIUM5.0PyPI
GHSA-p3pq-hxmr-vqqr· CVE-2026-7724, PYSEC-2026-2959Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url
Modified: 9/10/2026
HIGH8.8PyPI
PYSEC-2026-1799· CVE-2023-6022, GHSA-4hh5-2678-83fxCross-Site Request Forgery vulnerability in Prefect
Modified: 7/7/2026
HIGH7.6PyPI
PYSEC-2026-1800· CVE-2024-8183, GHSA-4v9f-r55g-g6hcPrefect CORS (Cross-Origin Resource Sharing) misconfiguration
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-2261· CVE-2026-3514, GHSA-c635-393c-hcx2Modified: 7/13/2026
MEDIUM6.3PyPI
PYSEC-2026-2955· CVE-2026-7725, GHSA-6rcx-55r6-jx65Prefect Git Argument Injection in GitRepository Pull Steps
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2956· CVE-2026-7722, GHSA-6rr6-v7cj-mxpgPrefect Auth Bypass via endswith() Health Check Exemption
Modified: 7/13/2026
HIGH8.5PyPI
PYSEC-2026-2957· CVE-2026-3515, GHSA-cw25-2p92-7f75Prefect has an Argument Injection issue
Modified: 7/13/2026
HIGH7.3PyPI
PYSEC-2026-2958· CVE-2026-7723, GHSA-hvph-5985-r63vPrefect Unauthenticated Event Injection via /api/events/in WebSocket
Modified: 7/13/2026
MEDIUM5.0PyPI
PYSEC-2026-2959· CVE-2026-7724, GHSA-p3pq-hxmr-vqqrPrefect SSRF Bypass via DNS Rebinding in validate_restricted_url
Modified: 7/13/2026