Vendor

    Openedx

    18 known vulnerabilities in products by Openedx, 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Openedx
    CriticalCVE-2026-42858

    Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint

    		9.9
    HighCVE-2022-46147

    Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields

    		8.4
    HighCVE-2026-53635

    Open edX Platform: Insufficient Permission on set_course_mode_price()

    		7.6
    MediumCVE-2026-55421

    Open edX Platform: SSRF in Studio Video Download Endpoint

    		6.8
    CriticalCVE-2025-68270

    CourseLimitedStaff Role Allows Studio Access

    		9.9
    HighCVE-2026-42860

    Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint

    		8.5
    MediumCVE-2026-85271

    Openedx-platform: Cross-site Scripting

    		6.1
    MediumCVE-2026-85272

    Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

    		4.3
    CriticalCVE-2024-43782

    openedx-translations's Atlas translations for Open edX missing validation

    		7.7
    MediumCVE-2026-97702

    Openedx-platform: Observable Response Discrepancy

    		5.3
    HighCVE-2024-22209

    XBlock custom auth does not respect JWT Scopes

    also in 1 other product

    		6.4
    MediumCVE-2026-53636

    Open edX LTI OAuth Replay Attack

    		4.7
    MediumCVE-2025-47942

    Learners on edX Platform can download python_lib.zip

    		5.3
    MediumCVE-2026-42857

    Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization

    		5.4
    MediumCVE-2026-34736

    Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API

    		5.3
    MediumCVE-2026-35404

    Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter

    		4.7
    MediumCVE-2023-23611

    xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation

    		5.4
    MediumCVE-2024-41806

    Open edX Platform's instructor upload CSV for cohort creation not Private by Default

    		5.3

    Products

    Products by Openedx
    Openedx-platform100
    Edx-platform40
    Openedx40