Login Request a demo
OP
Product
openedx-platform
by openedx · last CVE Sep 18, 2026
9
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 1High 1Medium 7Low 0
Severity
All severities9Critical1High1Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add openedx-platform to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42858
9.9
0%
May 11
Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
Affected: < 6fda1f120ff5a590d120ae1180185525f399c6d0
CVE-2026-53635
7.6
0%
Sep 2
Open edX Platform: Insufficient Permission on set_course_mode_price()
Affected: < 59bb6d669e4fdc24d96afb809e12119372d9e257
CVE-2026-55421
6.8
0%
Sep 2
Open edX Platform: SSRF in Studio Video Download Endpoint
Affected: < 00b7c3ce418b487c5696b064fc5033594b045e75
CVE-2026-85271
6.1
0%
Sep 18
Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)
Affected: >= release/redwood.1, < release/ulmo.4
CVE-2026-35404
6.1
0%
Apr 6
Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
Affected: < 76462f1e5fa9b37d2621ad7ad19514b403908970
CVE-2026-42857
5.4
0%
May 11
Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
Affected: < cddc25cd791bb78f76833896e4778f668861df12; >= sumac, < ulmo
CVE-2026-34736
5.3
0%
Apr 2
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
Affected: >= maple, < ulmo
CVE-2026-53636
4.7
0%
Sep 2
Open edX LTI OAuth Replay Attack
Affected: < 3a5ac856c79557c5c74d8b3e6578f289d7cceecd
CVE-2026-85272
4.3
0%
Sep 18
Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
Affected: >= release/aspen.1, < release/ulmo.4; >= release/aspen.1, < release/verawood.1
Showing 9