影響を受けるバージョン系列
- 2026.9 CVE 1 件
- 2026.8 CVE 4 件
- 2026.7 CVE 10 件
- 2026.6 CVE 11 件
- 2026.5 CVE 17 件
- 2026.4 CVE 18 件
- 2026.3 CVE 19 件
- 2026.2 CVE 19 件
- 2026.1 CVE 20 件
- 2025.11 CVE 20 件
- 2025.10 CVE 21 件
- 2025.9 CVE 21 件
- 2025.8 CVE 21 件
- 2025.7 CVE 21 件
- 2024.10 CVE 21 件
- 2024.7 CVE 21 件
- 2024.1 CVE 21 件
- 4.16 CVE 20 件
- 4.14 CVE 19 件
- 1.0 CVE 18 件
- 0.0 CVE 16 件
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-125744 | Missing permission check in ticket layout API | < 2026.7.4 ≥ 2026.8.0 < 2026.8.2 ≥ 2026.9.0 < 2026.9.1 | 1.2 | — | 2026-11-10 | |
| CVE-2026-101272 | Incorrect session validation for API-created shredder exports | < 2026.6.4 ≥ 2026.7.0 < 2026.7.3 ≥ 2026.8.0 < 2026.8.1 | 2.3 | — | 2026-10-28 | |
| CVE-2026-101274 | When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system... | < 2026.6.4 ≥ 2026.7.0 < 2026.7.3 ≥ 2026.8.0 < 2026.8.1 | 6.9 | — | 2026-10-28 | |
| CVE-2026-101273 | Giftcard enumeration | < 2026.6.4 ≥ 2026.7.0 < 2026.7.3 ≥ 2026.8.0 < 2026.8.1 | 5.3 | — | 2026-10-28 | |
| CVE-2026-101271 | OAuth credentials not disabled when application is disabled | ≥ 0.0 < 2026.5.5 ≥ 2026.6.0 < 2026.6.2 ≥ 2026.7.0 < 2026.7.1 | 2.1 | — | 2026-09-29 | |
| CVE-2026-101270 | HTML injection | ≥ 0.0 < 2026.5.5 ≥ 2026.6.0 < 2026.6.2 ≥ 2026.7.0 < 2026.7.1 | 2.1 | — | 2026-09-29 | |
| CVE-2026-101269 | Incorrect session validation for API-uploaded files | ≥ 0.0 < 2026.5.5 ≥ 2026.6.0 < 2026.6.2 ≥ 2026.7.0 < 2026.7.1 | 2.3 | — | 2026-09-29 | |
| CVE-2026-101268 | Customer session fixation | ≥ 0.0 < 2026.5.5 ≥ 2026.6.0 < 2026.6.2 ≥ 2026.7.0 < 2026.7.1 | 1.7 | — | 2026-09-29 | |
| CVE-2026-101267 | Revenue information leak | ≥ 0.0 < 2026.5.5 ≥ 2026.6.0 < 2026.6.2 ≥ 2026.7.0 < 2026.7.1 | 2.7 | — | 2026-09-29 | |
| CVE-2026-101266 | Checkout validation bypass | ≥ 0.0 < 2026.5.5 ≥ 2026.6.0 < 2026.6.2 ≥ 2026.7.0 < 2026.7.1 | 1.3 | — | 2026-09-29 | |
| CVE-2026-18028 | Missing authorization check in event quick setup view | < 2026.4.6 ≥ 2026.5.0 < 2026.5.4 ≥ 2026.6.0 < 2026.6.1 | 2.3 | — | 2026-07-28 | |
| CVE-2026-13602 | Session takeover vulnerability | ≥ 4.14.0 < 2026.3.5 ≥ 2026.4.0 < 2026.4.5 ≥ 2026.5.0 < 2026.5.3 | 7.7 | — | 2026-07-01 | |
| CVE-2026-57532 | Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed whe... | < 2026.3.4 ≥ 2026.4.0 < 2026.4.4 ≥ 2026.5.0 < 2026.5.2 | 8.8 | — | 2026-06-25 | |
| CVE-2026-57533 | Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occ... | < 2026.3.4 ≥ 2026.4.0 < 2026.4.4 ≥ 2026.5.0 < 2026.5.2 | 2.1 | — | 2026-06-25 | |
| CVE-2026-57535 | Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. I... | < 2026.3.4 ≥ 2026.4.0 < 2026.4.4 ≥ 2026.5.0 < 2026.5.2 | 2.1 | — | 2026-06-25 | |
| CVE-2026-13225 | Stored XSS in ticket confirmation page | < 2026.3.4 ≥ 2026.4.0 < 2026.4.4 ≥ 2026.5.0 < 2026.5.2 | 5.3 | — | 2026-06-25 | |
| CVE-2026-11764 | Data exposed without proper permission | ≥ 2024.1.0 < 2026.3.0 ≥ 2026.3.0 < 2026.4.0 ≥ 2026.4.0 < 2026.5.0 | 3.6 | — | 2026-06-09 | |
| CVE-2026-9712 | Insecure direct object reference | ≥ 2024.10.0 < 2026.2.0 ≥ 2026.2.0 < 2026.3.0 ≥ 2026.3.0 < 2026.4.0 | 3.8 | — | 2026-05-27 | |
| CVE-2026-5600 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific eve... | ≥ 2025.10.0 < 2026.1.2 ≥ 2026.2.0 < 2026.2.1 ≥ 2026.3.0 < 2026.3.1 | 5.5 | — | 2026-04-08 | |
| CVE-2026-2415 | Unsafe variable evaluation in email templates | ≥ 4.16.0 < 2025.9.0 ≥ 2025.9.0 < 2025.10.0 ≥ 2025.10.0 < 2026.1.0 | 7.5 | — | 2026-02-16 | |
| CVE-2025-14881 | Insecure direct object reference | ≥ 1.0.0 < 2025.8.0 ≥ 2025.8.0 < 2025.9.0 ≥ 2025.9.0 < 2025.10.0 | 3.8 | — | 2025-12-19 | |
| CVE-2025-13742 | Limited HTML injection in emails | ≥ 1.0.0 < 2025.7.0 ≥ 2025.7.0 < 2025.8.0 ≥ 2025.8.0 < 2025.9.0 | 2.4 | — | 2025-11-27 | |
| CVE-2024-8113 | Stored XSS in Placeholder Samples in Mail Preview | ≤ 2024.7.0 | 7.2 | — | 2024-08-23 | |
| CVE-2024-27447 | pretix before 2024.1.1 mishandles file validation. | * | 9.8 | — | 2024-02-26 | |
| CVE-2023-44463 | An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the applica... | * | 5.3 | — | 2023-10-02 | |
| CVE-2023-44464 | pretix before 2023.7.2 allows Pillow to parse EPS files. | * | — | — | 2023-09-29 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。