Vulnerabilities in openedx
18 resultsCVE-2022-46147HIGHDrag and Drop XBlock v2 has XSS Issues in Xblock Input FieldsEPSS 0.9%CVE-2024-22209MEDIUMXBlock custom auth does not respect JWT ScopesEPSS 0.6%CVE-2024-43782HIGHopenedx-translations's Atlas translations for Open edX missing validationEPSS 0.5%CVE-2026-85272MEDIUMOpen edX Platform: Path traversal via prefix-bypass in safe_extractall Path ValidationEPSS 0.5%CVE-2025-47942MEDIUMLearners on edX Platform can download python_lib.zipEPSS 0.5%CVE-2026-55421MEDIUMOpen edX Platform: SSRF in Studio Video Download EndpointEPSS 0.5%CVE-2026-53635HIGHOpen edX Platform: Insufficient Permission on set_course_mode_price()EPSS 0.4%CVE-2023-23611MEDIUMxblock-lti-consumer contain Missing Authorization in Grade Pass Back ImplementationEPSS 0.4%CVE-2026-42858HIGHOpen edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync EndpointEPSS 0.4%CVE-2026-85271MEDIUMOpen edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)EPSS 0.4%CVE-2024-41806MEDIUMOpen edX Platform's instructor upload CSV for cohort creation not Private by DefaultEPSS 0.3%CVE-2025-68270CRITICALCourseLimitedStaff Role Allows Studio AccessEPSS 0.3%CVE-2026-42860HIGHOpen edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpointEPSS 0.3%CVE-2026-53636MEDIUMOpen edX LTI OAuth Replay AttackEPSS 0.3%CVE-2026-97702MEDIUMOpen edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforceEPSS 0.2%CVE-2026-35404MEDIUMOpen edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url ParameterEPSS 0.2%CVE-2026-34736MEDIUMOpen edX Platform: Account Activation Bypass via activation_key Exposure in REST APIEPSS 0.2%CVE-2026-42857MEDIUMOpen edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML SanitizationEPSS 0.2%