Login Request a demo
PR
Product
prefect
by PrefectHQ · last CVE Jun 20, 2026
7
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 1High 3Medium 3Low 0
Severity
All severities7Critical1High3Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add prefect to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-5366
9.9
1%
Jun 20
Git Argument Injection in prefecthq/prefect
Affected: 3.6.23
CVE-2023-6022
8.8
0%
Nov 16
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5
Affected: All versions, or not specified
CVE-2026-3514
7.5
0%
Jun 2
Authentication Bypass in prefecthq/prefect
Affected: before 3.6.22
CVE-2026-7723
7.3
0%
May 4
PrefectHQ prefect WebSocket Endpoint in missing authentication
Affected: 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; +8 more
CVE-2026-7725
6.3
0%
May 4
PrefectHQ prefect GitRepository Pull storage.py argument injection
Affected: 3.6.25.dev6
CVE-2026-7722
5.3
0%
May 4
PrefectHQ prefect Health Check API health endswith improper authentication
Affected: 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; +16 more
CVE-2026-7724
5.0
0%
May 4
PrefectHQ prefect Webhook/Notification validate_restricted_url toctou
Affected: 3.6.28.dev1
Showing 7