CVE-2026-13314

LowCVSS 2.0/10Last modified Jun 25, 2026

Description

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

Metrics

CVSS 4.0 2.0/10CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-133164.4A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform anCVE-2026-133186.4A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to aCVE-2026-133194.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 tCVE-2026-13325.3MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access CVE-2026-133205.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 tCVE-2026-133218.6The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affectCVE-2026-133223.8A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), whiCVE-2026-133238.7In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a CoCVE-2026-133266.9An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limiteCVE-2026-133278.3Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positiCVE-2026-133285.3The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, whiCVE-2026-133296.5The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX
CVE-2026-13314: Low severity, CVSS 2.0 | Vulnix