Low
CVE-2026-9712
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 11
Reset filters
Low
CVE-2025-14881
pretix has Broken Access Control Allowing Cross-User File Access via UUID
Low
CVE-2025-14882
pretix has Broken Access Control Allowing Cross-User File Access via UUID
High
CVE-2023-44464
pretix allows Pillow to parse EPS files
Medium
CVE-2026-5600
A new API endpoint introduced in pretix 2025 that is supposed to
Medium
CVE-2026-2415
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name}
Medium
CVE-2025-13742
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final em
Medium
CVE-2024-8113
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of
Medium
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation.
Medium
CVE-2023-44463
An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to
High
CVE-2023-27891
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.