PR
Product
pretix
21
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 1High 2Medium 7Low 11
Watch
Add pretix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-9712 | 3.8 | May 27 | Insecure direct object reference Affected: 2024.10.0 before 2026.2.0; 2026.2.0 before 2026.3.0; 2026.3.0 before 2026.4.0; 2026.4.0 before 2026.5.0 |
| CVE-2025-14881 | 3.8 | Dec 19 | Insecure direct object reference Affected: 1.0.0 before 2025.8.0; 2025.8.0 before 2025.9.0; 2025.9.0 before 2025.10.0; 2025.10.0 before 2025.11.0 |
| CVE-2026-11764 | 3.6 | Jun 9 | Data exposed without proper permission Affected: 2024.1.0 before 2026.3.0; 2026.3.0 before 2026.4.0; 2026.4.0 before 2026.5.0; 2026.5.0 before 2026.6.0 |
| CVE-2026-101267 | 2.7 | Sep 29 | Revenue information leak Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101269 | 2.3 | Sep 29 | Incorrect session validation for API-uploaded files Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101271 | 2.1 | Sep 29 | OAuth credentials not disabled when application is disabled Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101270 | 2.1 | Sep 29 | HTML injection Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-57533 | 2.1 | Jun 25 | Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs Affected: before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 |
| CVE-2026-57535 | 2.1 | Jun 25 | Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags Affected: before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 |
| CVE-2026-101268 | 1.7 | Sep 29 | Customer session fixation Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
| CVE-2026-101266 | 1.3 | Sep 29 | Checkout validation bypass Affected: 0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 |
Showing 11