Log in Start free

openedx

Products

ProductCVEsExploitedLatest
openedx-platform10–Nov 4, 2026
edx-platform4–Dec 16, 2025
edx-enterprise1–May 11, 2026
openedx-translations1–Aug 23, 2024
xblock-drag-and-drop-v21–Nov 28, 2022
xblock-lti-consumer1–Jan 25, 2023

Exploited and recent CVEs

  • CVE-2026-97702 Medium 5.3 Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce 0.2%
  • CVE-2026-85271 Medium 6.1 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) 0.4%
  • CVE-2026-85272 Medium 4.3 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation 0.5%
  • CVE-2026-55421 Medium 6.8 Open edX Platform: SSRF in Studio Video Download Endpoint 0.5%
  • CVE-2026-53636 Medium 4.7 Open edX LTI OAuth Replay Attack 0.3%
  • CVE-2026-53635 High 7.6 Open edX Platform: Insufficient Permission on set_course_mode_price() 0.4%
  • CVE-2026-42860 High 8.5 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint 0.3%
  • CVE-2026-42857 Medium 4.6 Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization 0.2%
  • CVE-2026-42858 High 8.5 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint 0.4%
  • CVE-2026-35404 Medium 4.7 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter 0.2%
  • CVE-2026-34736 Medium 5.3 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API 0.2%
  • CVE-2025-68270 Critical 9.9 CourseLimitedStaff Role Allows Studio Access 0.3%
  • CVE-2025-47942 Medium 5.3 Learners on edX Platform can download python_lib.zip 0.5%
  • CVE-2024-43782 High 7.7 openedx-translations's Atlas translations for Open edX missing validation 0.5%
  • CVE-2024-41806 Medium 5.3 Open edX Platform's instructor upload CSV for cohort creation not Private by Default 0.3%
  • CVE-2024-22209 Medium 6.4 XBlock custom auth does not respect JWT Scopes 0.6%
  • CVE-2023-23611 Medium 5.4 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation 0.4%
  • CVE-2022-46147 High 8.4 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields 0.9%