openedx vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 20243
4. 20252
5. 202611

Newest CVEs

• CVE-2026-97702

  Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce

  openedx · openedx-platform

  Medium5.3
• CVE-2026-85271

  Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

  openedx · openedx-platform

  Medium6.1
• CVE-2026-85272

  Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

  openedx · openedx-platform

  Medium4.3
• CVE-2026-55421

  Open edX Platform: SSRF in Studio Video Download Endpoint

  openedx · openedx-platform

  Medium6.8
• CVE-2026-53636

  Open edX LTI OAuth Replay Attack

  openedx · openedx-platform

  Medium4.7
• CVE-2026-53635

  Open edX Platform: Insufficient Permission on set_course_mode_price()

  openedx · openedx-platform

  High7.6
• CVE-2026-42860

  Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint

  openedx · edx-enterprise

  High8.5
• CVE-2026-42857

  Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization

  openedx · openedx-platform

  Medium4.6
• CVE-2026-42858

  Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint

  openedx · openedx-platform

  High8.5
• CVE-2026-35404

  Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter

  openedx · openedx-platform

  Medium4.7