rami.io

Latest CVEs · RSS

• CVE-2026-101271 2026-09-29 · CVSS 2.1
  OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
• CVE-2026-101270 2026-09-29 · CVSS 2.1
  Malicious HTML content could be injected into the help texts of various fields with organizer permissions.
• CVE-2026-101269 2026-09-29 · CVSS 2.3
  The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based
• CVE-2026-101268 2026-09-29 · CVSS 1.7
  If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not noti
• CVE-2026-101267 2026-09-29 · CVSS 2.7
  A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. T
• CVE-2026-101266 2026-09-29 · CVSS 1.3
  A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
• CVE-2026-82838 2026-08-31 · CVSS 6.4
  The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A vali
• CVE-2026-18028 2026-07-28 · CVSS 2.3
  The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This vie
• CVE-2026-18029 2026-07-28 · CVSS 6.3
  Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from
• CVE-2026-13602 2026-07-01 · CVSS 7.7
  We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: *
• CVE-2026-13603 2026-07-01 · CVSS 9.0
  The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The int
• CVE-2026-13350 2026-06-25 · CVSS 2.3
  Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
• CVE-2026-57532 2026-06-25 · CVSS 8.8
  Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This c
• CVE-2026-57533 2026-06-25 · CVSS 2.1
  Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Polic
• CVE-2026-57535 2026-06-25 · CVSS 2.1
  Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an
• CVE-2026-13225 2026-06-25 · CVSS 5.3
  Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual
• CVE-2026-57534 2026-06-25 · CVSS 2.1
  Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.
• CVE-2026-57536 2026-06-25 · CVSS 6.3
  Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one pa
• CVE-2026-13222 2026-06-25 · CVSS 6.3
  Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status
• CVE-2026-13223 2026-06-25 · CVSS 6.3
  Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment sta
• CVE-2026-13314 2026-06-25 · CVSS 2.0
  Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.
• CVE-2026-12863 2026-06-22 · CVSS 5.1
  An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.
• CVE-2026-12862 2026-06-22 · CVSS 5.1
  Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of t
• CVE-2026-11764 2026-06-09 · CVSS 3.6
  When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not h
• CVE-2026-9712 2026-05-27 · CVSS 3.8
  When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839