PR
Product
pretix
21
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 1High 2Medium 7Low 11
Watch
Add pretix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2452 | 6.5 | Feb 16 | Unsafe variable evaluation in email templates Affected: 4.16.0 before 2026.1.1 |
| CVE-2026-2451 | 6.5 | Feb 16 | Unsafe variable evaluation in email templates Affected: 4.16.0 before 2026.1.1 |
| CVE-2025-13742 | 6.1 | Nov 27 | Limited HTML injection in emails Affected: 1.0.0 before 2025.7.0; 2025.7.0 before 2025.8.0; 2025.8.0 before 2025.9.0; 2025.9.0 before 2025.10.0 |
| CVE-2026-2415 | 5.9 | Feb 16 | Unsafe variable evaluation in email templates Affected: 4.16.0 before 2025.9.0; 2025.9.0 before 2025.10.0; 2025.10.0 before 2026.1.0; 2026.1.0 before 2026.1.1 |
| CVE-2024-8113 | 5.4 | Aug 23 | Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page Affected: through 2024.7.0 |
| CVE-2026-13225 | 5.3 | Jun 25 | Stored XSS in ticket confirmation page Affected: before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 |
| CVE-2026-5600 | 4.3 | Apr 8 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective… Affected: 2025.10.0 before 2026.1.2; 2026.2.0 before 2026.2.1; 2026.3.0 before 2026.3.1 |
Showing 7