Advisories · Technology
openedx-platform.
Every CVE that names openedx-platform among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce
- openedx-platform
- Broken access control
- CWE-204
- CVSS 6.1 Medium
Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)
- openedx-platform
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
- openedx-platform
- Path traversal
- CVSS 6.8 Medium
Open edX Platform: SSRF in Studio Video Download Endpoint
- openedx-platform
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
Open edX LTI OAuth Replay Attack
- openedx-platform
- Authentication bypass
- CVSS 7.6 High
Open edX Platform: Insufficient Permission on set_course_mode_price()
- openedx-platform
- Broken access control
- CVSS 4.6 Medium
Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
- openedx-platform
- Cross-site scripting (XSS)
- CVSS 8.5 High
Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
- openedx-platform
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
- openedx-platform
- Open redirect
- CVSS 5.3 Medium
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
- openedx-platform
- Authentication bypass