PR
Product
pretix
21
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 1High 2Medium 7Low 11
Watch
Add pretix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-27447 | 9.8 | Feb 26 | pretix before 2024.1.1 mishandles file validation Affected: before 2024.1.1 |
| CVE-2026-57532 | 8.8 | Jun 25 | Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser Affected: before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 |
| CVE-2026-13602 | 7.7 | Jul 1 | Session takeover vulnerability Affected: 4.14.0 before 2026.3.5; 2026.4.0 before 2026.4.5; 2026.5.0 before 2026.5.3 |
| CVE-2026-2452 | 6.5 | Feb 16 | Unsafe variable evaluation in email templates Affected: 4.16.0 before 2026.1.1 |
| CVE-2026-2451 | 6.5 | Feb 16 | Unsafe variable evaluation in email templates Affected: 4.16.0 before 2026.1.1 |
| CVE-2025-13742 | 6.1 | Nov 27 | Limited HTML injection in emails Affected: 1.0.0 before 2025.7.0; 2025.7.0 before 2025.8.0; 2025.8.0 before 2025.9.0; 2025.9.0 before 2025.10.0 |
| CVE-2026-2415 | 5.9 | Feb 16 | Unsafe variable evaluation in email templates Affected: 4.16.0 before 2025.9.0; 2025.9.0 before 2025.10.0; 2025.10.0 before 2026.1.0; 2026.1.0 before 2026.1.1 |
| CVE-2024-8113 | 5.4 | Aug 23 | Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page Affected: through 2024.7.0 |
| CVE-2026-13225 | 5.3 | Jun 25 | Stored XSS in ticket confirmation page Affected: before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 |
| CVE-2026-5600 | 4.3 | Apr 8 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective… Affected: 2025.10.0 before 2026.1.2; 2026.2.0 before 2026.2.1; 2026.3.0 before 2026.3.1 |
| CVE-2026-9712 | 3.8 | May 27 | Insecure direct object reference Affected: 2024.10.0 before 2026.2.0; 2026.2.0 before 2026.3.0; 2026.3.0 before 2026.4.0; 2026.4.0 before 2026.5.0 |
| CVE-2025-14881 | 3.8 | Dec 19 | Insecure direct object reference Affected: 1.0.0 before 2025.8.0; 2025.8.0 before 2025.9.0; 2025.9.0 before 2025.10.0; 2025.10.0 before 2025.11.0 |
| CVE-2026-11764 | 3.6 | Jun 9 | Data exposed without proper permission Affected: 2024.1.0 before 2026.3.0; 2026.3.0 before 2026.4.0; 2026.4.0 before 2026.5.0; 2026.5.0 before 2026.6.0 |
| CVE-2026-101267 | 2.7 | Sep 29 | Revenue information leak Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101269 | 2.3 | Sep 29 | Incorrect session validation for API-uploaded files Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101271 | 2.1 | Sep 29 | OAuth credentials not disabled when application is disabled Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101270 | 2.1 | Sep 29 | HTML injection Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-57533 | 2.1 | Jun 25 | Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs Affected: before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 |
| CVE-2026-57535 | 2.1 | Jun 25 | Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags Affected: before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 |
| CVE-2026-101268 | 1.7 | Sep 29 | Customer session fixation Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101266 | 1.3 | Sep 29 | Checkout validation bypass Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
Showing 21