# openedx-platform.

Every CVE that names openedx-platform among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Open edX: Support "manage_course_team" REST API omits the \`require_support_permission\` gate its sibling support views enforce](https://agentprime.io/advisories/CVE-2026-97702.md)
  `CVE-2026-97702` · CVE record: openedx openedx-platform · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-204
- [Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)](https://agentprime.io/advisories/CVE-2026-85271.md)
  `CVE-2026-85271` · CVE record: openedx openedx-platform · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation](https://agentprime.io/advisories/CVE-2026-85272.md)
  `CVE-2026-85272` · CVE record: openedx openedx-platform · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal
- [Open edX Platform: SSRF in Studio Video Download Endpoint](https://agentprime.io/advisories/CVE-2026-55421.md)
  `CVE-2026-55421` · CVE record: openedx openedx-platform · CVSS 6.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Open edX LTI OAuth Replay Attack](https://agentprime.io/advisories/CVE-2026-53636.md)
  `CVE-2026-53636` · CVE record: openedx openedx-platform · CVSS 4.7 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Open edX Platform: Insufficient Permission on set_course_mode_price()](https://agentprime.io/advisories/CVE-2026-53635.md)
  `CVE-2026-53635` · CVE record: openedx openedx-platform · CVSS 7.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization](https://agentprime.io/advisories/CVE-2026-42857.md)
  `CVE-2026-42857` · CVE record: openedx openedx-platform · CVSS 4.6 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS)
- [Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint](https://agentprime.io/advisories/CVE-2026-42858.md)
  `CVE-2026-42858` · CVE record: openedx openedx-platform · CVSS 8.5 High · Not analysed yet · Published 11 May 2026 · Tags: Server-side request forgery (SSRF)
- [Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter](https://agentprime.io/advisories/CVE-2026-35404.md)
  `CVE-2026-35404` · CVE record: openedx openedx-platform · CVSS 4.7 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Open redirect
- [Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API](https://agentprime.io/advisories/CVE-2026-34736.md)
  `CVE-2026-34736` · CVE record: openedx openedx-platform · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=openedx-platform>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/openedx-platform/>. Everything for agents: <https://agentprime.io/llms.txt>.