TI-2026-31065 CVE-2026-42858
Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
Priority HIGH 76
Open edX Platform enables the authoring and delivery of online learning at any scale.
openedx
Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
openedx records in CISA KEVNo openedx vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
18 records
TI-2022-22791 CVE-2022-46147 · GHSA-qv6c-367r-3w6q
Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
Priority HIGH 72
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image.
TI-2026-31067 CVE-2026-42860 · GHSA-64cv-vxpr-j6vc
Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint
Priority HIGH 70
The Open edx Enterprise Service app provides enterprise features to the Open edX platform.
Priority HIGH 66
Open edX Platform enables the authoring and delivery of online learning at any scale.
TI-2026-26980 CVE-2026-34736
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
Priority MEDIUM 63
Open edX Platform enables the authoring and delivery of online learning at any scale.
TI-2026-27540 CVE-2026-35404
Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
Priority MEDIUM 60
Open edX Platform enables the authoring and delivery of online learning at any scale.
TI-2026-31064 CVE-2026-42857
Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
Priority MEDIUM 58
Open edX Platform enables the authoring and delivery of online learning at any scale.
TI-2026-38680 CVE-2026-53636
Open edX LTI OAuth Replay Attack
Priority MEDIUM 55
Open edX Platform enables the authoring and delivery of online learning at any scale.
TI-2026-58564 CVE-2026-85272
Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
Priority MEDIUM 53
Open edX Platform enables the authoring and delivery of online learning at any scale.
TI-2024-29377 CVE-2024-43782
openedx-translations's Atlas translations for Open edX missing validation
Priority MEDIUM 44
This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex.
TI-2025-41846 CVE-2025-68270
CourseLimitedStaff Role Allows Studio Access
Priority MEDIUM 42
The Open edX Platform is a learning management platform.
TI-2024-14802 CVE-2024-22209
XBlock custom auth does not respect JWT Scopes
Priority MEDIUM 41
Open edX Platform is a service-oriented platform for authoring and delivering online learning.
Priority LOW 30
Open edX Platform enables the authoring and delivery of online learning at any scale.
Priority LOW 30
The Open edX Platform is a learning management platform.
TI-2024-27851 CVE-2024-41806
Open edX Platform's instructor upload CSV for cohort creation not Private by Default
Priority LOW 30
The Open edX Platform is a learning management platform.
TI-2026-58563 CVE-2026-85271
Cross-site scripting in openedx-platform
Priority LOW 27
Open edX Platform enables the authoring and delivery of online learning at any scale.
TI-2023-09440 CVE-2023-23611 · GHSA-7j9p-67mm-5g87
xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation
Priority LOW 25
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools.
Priority LOW 24
Open edX Platform enables the authoring and delivery of online learning at any scale.