openedx openedx-platform

• CVE-2026-97702 Medium 5.3 Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce 0.2%
• CVE-2026-85271 Medium 6.1 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) 0.4%
• CVE-2026-85272 Medium 4.3 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation 0.5%
• CVE-2026-55421 Medium 6.8 Open edX Platform: SSRF in Studio Video Download Endpoint 0.5%
• CVE-2026-53636 Medium 4.7 Open edX LTI OAuth Replay Attack 0.3%
• CVE-2026-53635 High 7.6 Open edX Platform: Insufficient Permission on set_course_mode_price() 0.4%
• CVE-2026-42857 Medium 4.6 Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization 0.2%
• CVE-2026-42858 High 8.5 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint 0.4%
• CVE-2026-35404 Medium 4.7 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter 0.2%
• CVE-2026-34736 Medium 5.3 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API 0.2%