Vulnerabilities

TI-2026-31064 CVE-2026-42857

Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization

MEDIUM 58

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00184 Published 2026-05-11 No fix listed CWE-79

TI-2026-31065 CVE-2026-42858

Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint

HIGH 76

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00374 Published 2026-05-11 Fixed in 6fda1f120ff5a590d120ae1180185525f399c6d0 CWE-918

TI-2026-27540 CVE-2026-35404

Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter

MEDIUM 60

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00227 Published 2026-04-06 Fixed in 76462f1e5fa9b37d2621ad7ad19514b403908970 CWE-601

TI-2024-29377 CVE-2024-43782

openedx-translations's Atlas translations for Open edX missing validation

MEDIUM 44

This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00542 Published 2024-08-23 No fix listed CWE-74

Vulnerabilities

Filters

Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization

Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint

Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter

openedx-translations's Atlas translations for Open edX missing validation