Vulnerabilities

TI-2026-85263 CVE-2026-97702

Missing support permission check in Open edX course team API

LOW 24

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00236 Published 2026-11-04 No fix listed CWE-204

TI-2026-58563 CVE-2026-85271

Cross-site scripting in openedx-platform

LOW 27

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00354 Published 2026-09-18 No fix listed CWE-79

TI-2026-58564 CVE-2026-85272

Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

MEDIUM 53

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00476 Published 2026-09-18 No fix listed CWE-22

TI-2026-39990 CVE-2026-55421

Open edX Platform: SSRF in Studio Video Download Endpoint

LOW 30

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00459 Published 2026-09-02 Fixed in 00b7c3ce418b487c5696b064fc5033594b045e75 CWE-918

TI-2026-38680 CVE-2026-53636

Open edX LTI OAuth Replay Attack

MEDIUM 55

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.0028 Published 2026-09-02 Fixed in 3a5ac856c79557c5c74d8b3e6578f289d7cceecd CWE-294

TI-2026-38679 CVE-2026-53635

Open edX Platform: Insufficient Permission on set_course_mode_price()

HIGH 66

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00397 Published 2026-09-02 Fixed in 59bb6d669e4fdc24d96afb809e12119372d9e257 CWE-862

TI-2026-31067 CVE-2026-42860 · GHSA-64cv-vxpr-j6vc

Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint

HIGH 70

The Open edx Enterprise Service app provides enterprise features to the Open edX platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00301 Published 2026-05-11 Fixed in 7.0.5 CWE-918

TI-2026-31064 CVE-2026-42857

Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization

MEDIUM 58

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00184 Published 2026-05-11 No fix listed CWE-79

TI-2026-31065 CVE-2026-42858

Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint

HIGH 76

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00374 Published 2026-05-11 Fixed in 6fda1f120ff5a590d120ae1180185525f399c6d0 CWE-918

TI-2026-27540 CVE-2026-35404

Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter

MEDIUM 60

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00227 Published 2026-04-06 Fixed in 76462f1e5fa9b37d2621ad7ad19514b403908970 CWE-601

TI-2026-26980 CVE-2026-34736

Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API

MEDIUM 63

Open edX Platform enables the authoring and delivery of online learning at any scale.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00219 Published 2026-04-02 No fix listed CWE-287

TI-2025-41846 CVE-2025-68270

CourseLimitedStaff Role Allows Studio Access

MEDIUM 42

The Open edX Platform is a learning management platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00321 Published 2025-12-16 Fixed in 05d0d0936daf82c476617257aa6c35f0cd4ca060 CWE-862

TI-2025-30335 CVE-2025-47942

Learners on edX Platform can download python_lib.zip

LOW 30

The Open edX Platform is a learning management platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00462 Published 2025-05-21 Fixed in 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba CWE-862

TI-2024-29377 CVE-2024-43782

openedx-translations's Atlas translations for Open edX missing validation

MEDIUM 44

This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00542 Published 2024-08-23 No fix listed CWE-74

TI-2024-27851 CVE-2024-41806

Open edX Platform's instructor upload CSV for cohort creation not Private by Default

LOW 30

The Open edX Platform is a learning management platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00331 Published 2024-07-25 No fix listed CWE-284

TI-2024-14802 CVE-2024-22209

XBlock custom auth does not respect JWT Scopes

MEDIUM 41

Open edX Platform is a service-oriented platform for authoring and delivering online learning.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00574 Published 2024-01-13 No fix listed CWE-284

TI-2023-09440 CVE-2023-23611 · GHSA-7j9p-67mm-5g87

xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation

LOW 25

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00394 Published 2023-01-25 Fixed in 7.2.2 CWE-862

TI-2022-22791 CVE-2022-46147 · GHSA-qv6c-367r-3w6q

Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields

HIGH 72

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00896 Published 2022-11-28 Fixed in 3.0.0 CWE-79

Vulnerabilities

Filters