CVE-2026-85272 | Medium | 4.3 | 2026-09-18 | Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive… |
CVE-2026-85271 | Medium | 6.1 | 2026-09-18 | Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_… |
CVE-2026-55421 | Medium | 6.8 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url… |
CVE-2026-53636 | Medium | 4.7 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in… |
CVE-2026-53635 | High | 7.6 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms… |
CVE-2026-42860 | High | 8.5 | 2026-05-11 | The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProvider… |
CVE-2026-42858 | High | 8.5 | 2026-05-11 | Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authent… |
CVE-2026-42857 | Medium | 4.6 | 2026-05-11 | Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notificat… |
CVE-2026-35404 | Medium | 4.7 | 2026-04-06 | Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is pas… |
CVE-2026-34736 | Medium | 5.3 | 2026-04-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated att… |
CVE-2025-68270 | Critical | 9.9 | 2025-12-16 | The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to acc… |
CVE-2025-47942 | Medium | 5.3 | 2025-05-21 | The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against do… |
CVE-2024-43782 | High | 7.7 | 2024-08-23 | This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translat… |
CVE-2024-41806 | Medium | 5.3 | 2024-07-25 | The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor da… |
CVE-2024-22209 | Medium | 6.4 | 2024-01-13 | Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints e… |
CVE-2023-23611 | Medium | 5.4 | 2023-01-26 | LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, pri… |
CVE-2022-46147 | High | 8.4 | 2022-11-28 | Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vul… |