OP
Vendor
openedx
21
CVEs
0
On KEV
0
New 30D
Products
OP9.9
openedx-platform
openedx
9 CVEs0 on KEV0 new
ED9.9
edx-platform
openedx
4 CVEs0 on KEV0 new
OP9.9
Openedx
Openedx
4 CVEs0 on KEV0 new
ED8.5
edx-enterprise
openedx
1 CVEs0 on KEV0 new
OP9.8
openedx-translations
openedx
1 CVEs0 on KEV0 new
XB6.1
Xblock-drag-and-drop-v2
Openedx
1 CVEs0 on KEV0 new
XB5.4
Xblock-lti-consumer
Openedx
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85271 | OP openedx-platform openedx | 6.1 | Sep 18 | Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) |
| CVE-2026-85272 | OP openedx-platform openedx | 4.3 | Sep 18 | Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation |
| CVE-2026-55421 | OP openedx-platform openedx | 6.8 | Sep 2 | Open edX Platform: SSRF in Studio Video Download Endpoint |
| CVE-2026-53636 | OP openedx-platform openedx | 4.7 | Sep 2 | Open edX LTI OAuth Replay Attack |
| CVE-2026-53635 | OP openedx-platform openedx | 7.6 | Sep 2 | Open edX Platform: Insufficient Permission on set_course_mode_price() |
| CVE-2026-42860 | ED edx-enterprise openedx | 8.5 | May 11 | Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint |
| CVE-2026-42857 | OP openedx-platform openedx | 5.4 | May 11 | Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization |
| CVE-2026-42858 | OP openedx-platform openedx | 9.9 | May 11 | Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint |
| CVE-2026-35404 | OP openedx-platform openedx | 6.1 | Apr 6 | Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter |
| CVE-2026-34736 | OP openedx-platform openedx | 5.3 | Apr 2 | Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API |
| CVE-2025-68270 | ED edx-platform openedx | 9.9 | Dec 16 | CourseLimitedStaff Role Allows Studio Access |
| CVE-2025-47942 | ED edx-platform openedx | 5.3 | May 21 | Learners on edX Platform can download python_lib.zip |
| CVE-2024-43782 | OP openedx-translations openedx | 9.8 | Aug 23 | openedx-translations's Atlas translations for Open edX missing validation |
| CVE-2024-41806 | ED edx-platform openedx | 5.3 | Jul 25 | Open edX Platform's instructor upload CSV for cohort creation not Private by Default |
| CVE-2024-22209 | ED edx-platform openedx | 8.8 | Jan 13 | XBlock custom auth does not respect JWT Scopes |
| CVE-2023-23611 | XB Xblock-lti-consumer Openedx | 5.4 | Jan 26 | LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools |
| CVE-2022-46147 | XB Xblock-drag-and-drop-v2 Openedx | 6.1 | Nov 28 | Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image |