CVE-2026-101270

LowCVSS 2.1/10Last modified Sep 29, 2026

Description

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

Metrics

CVSS 4.0 2.1/10CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
pretixpretix>= 0.0, < 2026.5.5; >= 2026.6.0, < 2026.6.2; >= 2026.7.0, < 2026.7.1

References

Timeline

Published
Sep 29, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1012712.1OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is CVE-2026-1012722.3The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session CVE-2026-1012735.3Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was noCVE-2026-1012746.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate theCVE-2026-1012756.3Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status resCVE-2026-1012769.2iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees sCVE-2026-1012776.5A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set oCVE-2026-1012784.3A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file liboCVE-2026-1012796.5A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libCVE-2026-101286.5IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environmCVE-2026-1012807.3A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the cCVE-2026-1012817.3A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mai
CVE-2026-101270: Low severity, CVSS 2.1 | Vulnix