Pretix vulnerabilities

Products

• Pretix 22
• Venueless 6
• Pretix-oppwa 3
• Pretix-mollie 2

Newest

• pretix OAuth credentials not disabled when application is disabled CVE-2026-101271 2.1 LowSeptember 29, 2026
• pretix HTML injection CVE-2026-101270 2.1 LowSeptember 29, 2026
• pretix Incorrect session validation for API-uploaded files CVE-2026-101269 2.3 LowSeptember 29, 2026
• pretix Customer session fixation CVE-2026-101268 1.7 LowSeptember 29, 2026
• pretix Revenue information leak CVE-2026-101267 2.7 LowSeptember 29, 2026
• pretix Checkout validation bypass CVE-2026-101266 1.3 LowSeptember 29, 2026
• pretix venueless Default webserver configuration with incorrect CSP CVE-2026-82838 6.4 MediumAugust 31, 2026
• pretix Missing authorization check in event quick setup view CVE-2026-18028 2.3 LowJuly 28, 2026
• pretix, pretix pretix-bitpay, pretix-mollie +5 more +7 more Session takeover vulnerability CVE-2026-13602 7.7 HighJuly 1, 2026
• pretix pretix-oppwa SSRF with API key leak in pretix-oppwa CVE-2026-13603 9.0 CriticalJuly 1, 2026
• pretix venueless Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. CVE-2026-13350 2.3 LowJune 25, 2026
• pretix Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was... CVE-2026-57532 8.8 HighJune 25, 2026
• pretix Malicious HTML content could be injected into the page pretix shows when redirection to an... CVE-2026-57533 2.1 LowJune 25, 2026
• pretix Content injected to PDF rendering contexts could, in many places, include HTML content including ... CVE-2026-57535 2.1 LowJune 25, 2026
• pretix Stored XSS in ticket confirmation page CVE-2026-13225 5.3 MediumJune 25, 2026
• pretix pretix-pages Stored XSS in pretix-pages CVE-2026-57534 2.1 LowJune 25, 2026
• pretix pretix-mollie Insufficient validation of payment status in pretix-mollie CVE-2026-57536 6.3 MediumJune 25, 2026
• pretix pretix-oppwa Insufficient validation of payment status in pretix-oppwa CVE-2026-13222 6.3 MediumJune 25, 2026
• pretix pretix-computop Insufficient validation of payment status in pretix-computop CVE-2026-13223 6.3 MediumJune 25, 2026
• pretix pretix-digital Stored XSS in pretix-digital CVE-2026-13314 2.0 LowJune 25, 2026
• pretix venueless Open redirect CVE-2026-12863 5.1 MediumJune 22, 2026
• pretix venueless XLSX formula injection in exports CVE-2026-12862 5.1 MediumJune 22, 2026
• pretix Data exposed without proper permission CVE-2026-11764 3.6 LowJune 9, 2026
• pretix Insecure direct object reference CVE-2026-9712 Fix available 3.8 LowMay 27, 2026
• pretix pretix: API leaks check-in data between events of the same organizer CVE-2026-5600 Fix available 5.5 MediumApril 8, 2026
• pretix venueless API allows deletion of users of other instance CVE-2026-5599 7.3 HighApril 5, 2026
• pretix venueless Unauthorized access to chat contents CVE-2026-4982 7.3 HighMarch 27, 2026
• pretix, pretix newsletters, pretix-newsletter +2 more Unsafe variable evaluation in email templates CVE-2026-2452 7.5 HighFebruary 16, 2026
• pretix, pretix double opt in step, pretix-doistep +2 more Unsafe variable evaluation in email templates CVE-2026-2451 7.5 HighFebruary 16, 2026
• pretix Unsafe variable evaluation in email templates CVE-2026-2415 Fix available 7.5 HighFebruary 16, 2026
• pretix Insecure direct object reference CVE-2025-14881 Fix available 3.8 LowDecember 19, 2025
• pretix pretix-offlinesales Insecure direct object reference CVE-2025-14882 Fix available 3.8 LowDecember 19, 2025
• pretix Limited HTML injection in emails CVE-2025-13742 Fix available 2.4 LowNovember 27, 2025
• pretix Stored XSS in Placeholder Samples in Mail Preview CVE-2024-8113 Fix available 7.2 HighAugust 23, 2024
• pretix pretix mishandles file validation CVE-2024-27447 Fix available 9.8 CriticalFebruary 26, 2024