Priority MEDIUM 44
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00771 · Published 2026-11-01 · Fixed in 0.21.0 CWE-269
Priority MEDIUM 42
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00977 · Published 2026-08-11 · No fix listed CWE-88
Priority HIGH 76
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class.
CVSS 3.0CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01034 · Published 2026-06-20 · Fixed in 3.6.25 CWE-94
Priority HIGH 72
In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00476 · Published 2026-06-02 · Fixed in 3.6.22, 3.6.22.dev7 CWE-863
Priority LOW 37
A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field.
CVSS 3.0HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00298 · Published 2026-05-24 · No fix listed CWE-88
Priority MEDIUM 57
A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00247 · Published 2026-05-04 · Fixed in 3.6.25.dev7 CWE-74
Priority MEDIUM 45
A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.0025 · Published 2026-05-04 · Fixed in 3.6.28.dev2 CWE-362
Priority HIGH 70
A flaw has been found in PrefectHQ prefect up to 3.6.13.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00421 · Published 2026-05-04 · Fixed in 3.6.14 CWE-287
Priority HIGH 70
A vulnerability was detected in PrefectHQ prefect up to 3.6.21.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00453 · Published 2026-05-04 · Fixed in 3.6.22 CWE-287
Priority HIGH 82
FastMCP is a Pythonic way to build MCP servers and clients.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00925 · Published 2026-04-02 · Fixed in 3.2.0 CWE-918
Priority HIGH 66
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data.
CVSS 3.0HIGH 7.6· Network · No auth · User interaction · EPSS 0.00184 · Published 2025-03-20 · Fixed in 3.0.3, 2.20.17 CWE-346
Priority LOW 38
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00392 · Published 2023-11-16 · Fixed in 2.16.5 CWE-352
THREATIST.IORead the docs