Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-82838

Default webserver configuration with incorrect CSP

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Venueless
CVE-2026-13350

Incorrect Permission Check During Room Creation in Venueless

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Venueless
CVE-2026-12862

XLSX formula injection in exports

Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Venueless
CVE-2026-12863

Open redirect

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Venueless
CVE-2026-5599

API allows deletion of users of other instance

A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Venueless
CVE-2026-4982

Unauthorized access to chat contents

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Venueless