Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,809All CVEsplus 19,170 rejected
- 344Last 24 hours4,874 in the last 7 days
- 16,874Last 30 days1,489 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 7 | 11 | 15 | 0 | 34 | 38 |
| 2025 | 0 | 0 | 0 | 3 | 0 | 3 | 4 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-125744 | Missing permission check in ticket layout APIpretix · pretix | Low1.2 |
| CVE-2026-101275 | Insufficient validation of payment status in pretix-adyenpretix · pretix-adyen | Medium6.3 |
| CVE-2026-101272 | Incorrect session validation for API-created shredder exportspretix · pretix | Low2.3 |
| CVE-2026-101274 | When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type`…pretix · pretix | Medium6.9 |
| CVE-2026-101273 | Giftcard enumerationpretix · pretix | Medium5.3 |
| CVE-2026-101271 | OAuth credentials not disabled when application is disabledpretix · pretix | Low2.1 |
| CVE-2026-101270 | HTML injectionpretix · pretix | Low2.1 |
| CVE-2026-101269 | Incorrect session validation for API-uploaded filespretix · pretix | Low2.3 |
| CVE-2026-101268 | Customer session fixationpretix · pretix | Low1.7 |
| CVE-2026-101267 | Revenue information leakpretix · pretix | Low2.7 |
| CVE-2026-101266 | Checkout validation bypasspretix · pretix | Low1.3 |
| CVE-2026-82838 | Default webserver configuration with incorrect CSPpretix · venueless | Medium6.4 |
| CVE-2026-13602 | Session takeover vulnerabilitypretix · pretix | High7.7 |
| CVE-2026-13603 | SSRF with API key leak in pretix-oppwapretix · pretix-oppwa | Critical9.0 |
| CVE-2026-13350 | Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.pretix · Venueless | Low2.3 |
| CVE-2026-57532 | Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This…pretix · pretix | High8.8 |
| CVE-2026-57533 | Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a…pretix · pretix | Low2.1 |
| CVE-2026-57535 | Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an…pretix · pretix | Low2.1 |
| CVE-2026-13225 | Stored XSS in ticket confirmation pagepretix · pretix | Medium5.3 |
| CVE-2026-57534 | Stored XSS in pretix-pagespretix · pretix-pages | Low2.1 |
| CVE-2026-57536 | Insufficient validation of payment status in pretix-molliepretix · pretix-mollie | Medium6.3 |
| CVE-2026-13222 | Insufficient validation of payment status in pretix-oppwapretix · pretix-oppwa | Medium6.3 |
| CVE-2026-13223 | Insufficient validation of payment status in pretix-computoppretix · pretix-computop | Medium6.3 |
| CVE-2026-13314 | Stored XSS in pretix-digitalpretix · pretix-digital | Low2.0 |
| CVE-2026-12863 | Open redirectpretix · Venueless | Medium5.1 |
| CVE-2026-12862 | XLSX formula injection in exportspretix · Venueless | Medium5.1 |
| CVE-2026-11764 | Data exposed without proper permissionpretix · pretix | Low3.6 |
| CVE-2026-9712 | Insecure direct object referencepretix · pretix | Low3.8 |
| CVE-2026-5600 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging…pretix · pretix | Medium5.5 |
| CVE-2026-5599 | API allows deletion of users of other instancepretix · Venueless | High7.3 |
| CVE-2026-4982 | Unauthorized access to chat contentspretix · Venueless | High7.3 |
| CVE-2026-2452 | Unsafe variable evaluation in email templatespretix · pretix-newsletter | High7.5 |
| CVE-2026-2451 | Unsafe variable evaluation in email templatespretix · pretix-doistep | High7.5 |
| CVE-2026-2415 | Unsafe variable evaluation in email templatespretix · pretix | High7.5 |
| CVE-2025-14881 | Insecure direct object referencepretix · pretix | Low3.8 |
| CVE-2025-14882 | Insecure direct object referencepretix · pretix-offlinesales | Low3.8 |
| CVE-2025-13742 | Limited HTML injection in emailspretix · pretix | Low2.4 |
| CVE-2024-8113 | Stored XSS in Placeholder Samples in Mail Previewpretix · pretix | High7.2 |