Openedx vulnerabilities

Products

• Openedx-platform 9
• Edx-platform 4
• Openedx 4

Newest

• openedx openedx-platform Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) CVE-2026-85271 6.1 MediumSeptember 18, 2026
• openedx openedx-platform Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation CVE-2026-85272 4.3 MediumSeptember 18, 2026
• openedx openedx-platform Open edX Platform: SSRF in Studio Video Download Endpoint CVE-2026-55421 6.8 MediumSeptember 2, 2026
• openedx openedx-platform Open edX LTI OAuth Replay Attack CVE-2026-53636 4.7 MediumSeptember 2, 2026
• openedx openedx-platform Open edX Platform: Insufficient Permission on set_course_mode_price() CVE-2026-53635 7.6 HighSeptember 2, 2026
• openedx, openedx openedx-platform +1 more Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization CVE-2026-42857 4.6 MediumMay 11, 2026
• openedx, openedx openedx-platform +1 more Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVE-2026-42858 8.5 HighMay 11, 2026
• openedx edx-enterprise Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint CVE-2026-42860 Fix available 8.5 HighMay 5, 2026
• openedx, openedx openedx-platform +1 more Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVE-2026-35404 4.7 MediumApril 6, 2026
• openedx openedx-platform Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVE-2026-34736 5.3 MediumApril 2, 2026
• openedx edx-platform CourseLimitedStaff Role Allows Studio Access CVE-2025-68270 9.9 CriticalDecember 16, 2025
• openedx edx-platform Learners on edX Platform can download python_lib.zip CVE-2025-47942 5.3 MediumMay 21, 2025
• openedx, openedx openedx-translations +1 more openedx-translations's Atlas translations for Open edX missing validation CVE-2024-43782 7.7 HighAugust 23, 2024
• openedx edx-platform Open edX Platform's instructor upload CSV for cohort creation not Private by Default CVE-2024-41806 5.3 MediumJuly 25, 2024
• edx edx-platform XBlock custom auth does not respect JWT Scopes CVE-2024-22209 6.4 MediumJanuary 13, 2024
• openedx xblock-lti-consumer xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation CVE-2023-23611 Fix available 5.4 MediumJanuary 25, 2023
• openedx xblock-drag-and-drop-v2 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields CVE-2022-46147 Fix available 8.4 HighNovember 28, 2022