Log in Start free

pretix

Products

ProductCVEsExploitedLatest
pretix21–Oct 28, 2026
Venueless6–Aug 31, 2026
pretix-oppwa3–Jul 1, 2026
pretix-mollie2–Jul 1, 2026
pretix-doistep1–Feb 16, 2026
pretix-newsletter1–Feb 16, 2026
pretix-offlinesales1–Dec 19, 2025
pretix-pages1–Jun 25, 2026
pretix-payone1–Jul 1, 2026
pretix-saferpay1–Jul 1, 2026
pretix-secuconnect1–Jul 1, 2026
pretix-sofort1–Jul 1, 2026
pretix-computop1–Jun 25, 2026
pretix-bitpay1–Jul 1, 2026
pretix-digital1–Jun 25, 2026

Exploited and recent CVEs

  • CVE-2026-101272 Low 2.3 Incorrect session validation for API-created shredder exports 0.3%
  • CVE-2026-101274 Medium 6.9 When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request again 0.4%
  • CVE-2026-101273 Medium 5.3 Giftcard enumeration 0.3%
  • CVE-2026-101271 Low 2.1 OAuth credentials not disabled when application is disabled 0.2%
  • CVE-2026-101270 Low 2.1 HTML injection 0.2%
  • CVE-2026-101269 Low 2.3 Incorrect session validation for API-uploaded files 0.2%
  • CVE-2026-101268 Low 1.7 Customer session fixation 0.2%
  • CVE-2026-101267 Low 2.7 Revenue information leak 0.2%
  • CVE-2026-101266 Low 1.3 Checkout validation bypass 0.3%
  • CVE-2026-82838 Medium 6.4 Default webserver configuration with incorrect CSP 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13602 High 7.7 Session takeover vulnerability 0.4%
  • CVE-2026-13603 Critical 9.0 SSRF with API key leak in pretix-oppwa 0.4%
  • CVE-2026-13350 Low 2.3 Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. 0.3%
  • CVE-2026-57532 High 8.8 Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject Ja 0.4%
  • CVE-2026-57533 Low 2.1 Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing 0.3%
  • CVE-2026-57535 Low 2.1 Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would do 0.4%
  • CVE-2026-13225 Medium 5.3 Stored XSS in ticket confirmation page 0.4%
  • CVE-2026-57534 Low 2.1 Stored XSS in pretix-pages 0.4%
  • CVE-2026-57536 Medium 6.3 Insufficient validation of payment status in pretix-mollie 0.3%
  • CVE-2026-13222 Medium 6.3 Insufficient validation of payment status in pretix-oppwa 0.3%
  • CVE-2026-13223 Medium 6.3 Insufficient validation of payment status in pretix-computop 0.3%
  • CVE-2026-13314 Low 2.0 Stored XSS in pretix-digital 0.4%
  • CVE-2026-12863 Medium 5.1 Open redirect 0.4%