simmate (>=0.7.0, <=0.7.1) potentially affected by CVE-2026-7722 via prefect (2.0.0b8)

prefect PYPI version 2.0.0b8 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - simmate =0.7.0, =0.7.1 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

enrichsdk (>=5.3.0, <=5.5.7) potentially affected by CVE-2026-7722 via prefect (2.16.5)

prefect PYPI version 2.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - enrichsdk =5.3.0, =5.5.7 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

simmate (>=0.8.0, <=0.9.0) potentially affected by CVE-2026-7722 via prefect (2.0.4)

prefect PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - simmate =0.8.0, =0.9.0 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

blackmesa-dbt (>=0.1.0, <=0.1.1), ert (2.28.2) +3 more potentially affected by CVE-2026-7722 via prefect (2.20.26)

prefect PYPI version 2.20.26 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - blackmesa-dbt =0.1.0, =0.6.0, =0.5.0, =2.1.12, =2.3.5 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

investigraph (>=0.3.2, <=0.5.2) potentially affected by CVE-2026-7722 via prefect (2.16.8)

prefect PYPI version 2.16.8 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - investigraph =0.3.2, =0.5.2 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

ert (>=2.37.0, <=5.1.0b1), sagetasks (>=0.1.0a0, <=0.1.0a5) potentially affected by CVE-2026-7722 via prefect (2.0.0b16)

prefect PYPI version 2.0.0b16 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - ert =2.37.0, =0.1.0a0, =0.1.0a5 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

GHSA-P3PQ-HXMR-VQQR Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

cmip6-downscaling (1.1.1), cupyopt (>=0.15.13.1, <=0.15.13.2) +4 more potentially affected by CVE-2026-7722 via prefect (0.15.13)

prefect PYPI version 0.15.13 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cmip6-downscaling 1.1.1 - cupyopt =0.15.13.1, =0.1.8, =0.1.0, =0.1.10a0 - soam 0.10.2 Source cves: CVE-2026-7722 Source advisory:...

cvapipe-analysis (0.1.4) potentially affected by CVE-2026-7722 via prefect (0.14.15)

prefect PYPI version 0.14.15 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cvapipe-analysis 0.1.4 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

edx-prefectutils (>=1.0.7, <=2.0.0) potentially affected by CVE-2026-7722 via prefect (0.14.5)

prefect PYPI version 0.14.5 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - edx-prefectutils =1.0.7, =2.0.0 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

GHSA-6RR6-V7CJ-MXPG Prefect Auth Bypass via endswith() Health Check Exemption

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...

omicidx (>=0.9.0.9000, <=1.0.2.0), statline-bq (0.1.0) potentially affected by CVE-2026-7722 via prefect (0.13.19)

prefect PYPI version 0.13.19 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - omicidx =0.9.0.9000, =1.0.2.0 - statline-bq 0.1.0 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

aws-pcluster-helpers (>=1.0.17, <=1.0.20) potentially affected by CVE-2026-7722 via prefect (1.0.0)

prefect PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - aws-pcluster-helpers =1.0.17, =1.0.20 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

mesiqi (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-7722 via prefect (0.15.7)

prefect PYPI version 0.15.7 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - mesiqi =0.0.1, =0.0.2 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

GHSA-HVPH-5985-R63V Prefect Unauthenticated Event Injection via /api/events/in WebSocket

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be...

CVE-2026-7723

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be...

CVE-2026-7724

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

CVE-2026-7722

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...

abm-colony-collection (>=0.1.0, <=0.5.0), abm-initialization-collection (>=0.1.0, <=0.7.0) +126 more potentially affected by CVE-2026-7725 via prefect (>=0.9.2, <=3.6.24)

prefect PYPI version =0.9.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.16.0, =0.0.126, =0.1.0, =1.0.4, =3.4.0, =0.4.0b0, =0.1.11, =0.1.0, =0.5.0 and more Source cves: CVE-2026-7725 Source advisory: MEND:CVE-2026-7725...