Openedx Openedx-platform vulnerabilities

• openedx openedx-platform Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce CVE-2026-97702 5.3 MediumNovember 4, 2026
• openedx openedx-platform Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) CVE-2026-85271 6.1 MediumSeptember 18, 2026
• openedx openedx-platform Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation CVE-2026-85272 4.3 MediumSeptember 18, 2026
• openedx openedx-platform Open edX Platform: SSRF in Studio Video Download Endpoint CVE-2026-55421 6.8 MediumSeptember 2, 2026
• openedx openedx-platform Open edX LTI OAuth Replay Attack CVE-2026-53636 4.7 MediumSeptember 2, 2026
• openedx openedx-platform Open edX Platform: Insufficient Permission on set_course_mode_price() CVE-2026-53635 7.6 HighSeptember 2, 2026
• openedx, openedx openedx-platform +1 more Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization CVE-2026-42857 4.6 MediumMay 11, 2026
• openedx, openedx openedx-platform +1 more Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVE-2026-42858 8.5 HighMay 11, 2026
• openedx, openedx openedx-platform +1 more Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVE-2026-35404 4.7 MediumApril 6, 2026
• openedx openedx-platform Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVE-2026-34736 5.3 MediumApril 2, 2026