Moodle Project

Products

Exploited and recent CVEs

• CVE-2026-119556 Medium 4.3 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems 0.3%
• CVE-2026-119555 Medium 4.3 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback 0.2%
• CVE-2026-119554 Medium 5.9 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber 0.2%
• CVE-2026-119553 Medium 6.5 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal 0.4%
• CVE-2025-26533 High 8.1 SQL injection risk in course search module list filter 0.6%
• CVE-2025-26532 Low 3.1 Teachers can evade trusttext config when restoring glossary entries 0.3%
• CVE-2025-26531 Low 3.1 IDOR in badges allows disabling of arbitrary badges 0.3%
• CVE-2025-26530 High 8.3 Reflected XSS via question bank filter 0.4%
• CVE-2025-26529 High 8.3 Stored XSS risk in admin live log 0.5%
• CVE-2025-26528 Low 3.4 Stored XSS in ddimageortext question type 0.3%
• CVE-2025-26527 Medium 5.3 Non-searchable tags can still be discovered on the tag search page and in the tags block 0.4%
• CVE-2025-26526 Medium 6.5 Feedback response viewing and deletions did not respect Separate Groups mode 0.3%
• CVE-2025-26525 High 8.6 Arbitrary file read risk through pdfTeX 0.4%