Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configured sender address by embedding malformed HTML or markdown link syntax in a user-controlled template placeholder such as the account display name. The most direct vector is the password-reset flow: the attacker registers an account with a malicious name, enters the victim's email address, and triggers a password reset. The resulting email is delivered from the event's legitimate sender address and passes SPF/DKIM/DMARC validation, making it a ready-made phishing vector. This vulnerability is fixed in 2026.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | Disclosure1 |
| 2026-04-25 | 1 | General1 |
CVE-2026-41426 Unauthenticated Arbitrary Email Injection in Pretalx Prior to 2026.1.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41426
Post summary
The post references CVE-2026-41426 as an unauthenticated arbitrary email injection vulnerability in Pretalx versions before 2026.1.0, but offers no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-41426 pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configured sen… https://www.cve.org/CVERecord?id=CVE-2026-41426
Post summary
CVE-2026-41426 discloses that Pretalx allows unauthenticated attackers to send arbitrary HTML‑rendered emails; the post provides technical details but no PoC, exploit code, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pretalx | pretalx | - | - | - |