pretix Venueless

• CVE-2026-82838 Medium 6.4 Default webserver configuration with incorrect CSP 0.4%
• CVE-2026-13350 Low 2.3 Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. 0.3%
• CVE-2026-12863 Medium 5.1 Open redirect 0.4%
• CVE-2026-12862 Medium 5.1 XLSX formula injection in exports 0.4%
• CVE-2026-5599 High 7.3 API allows deletion of users of other instance 0.2%
• CVE-2026-4982 High 7.3 Unauthorized access to chat contents 0.2%