openedx-platform
- Software type
- Web application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/12/2026, openedx-platform recorded 5 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of openedx-platform and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-85271Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)CVE-2026-85272Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path ValidationCVE-2026-55421Open edX Platform: SSRF in Studio Video Download EndpointCVE-2026-53636Open edX LTI OAuth Replay AttackCVE-2026-53635Open edX Platform: Insufficient Permission on set_course_mode_price()| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-85271Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-85272Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation | Exploitation statusActively exploited | FixYes | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-55421Open edX Platform: SSRF in Studio Video Download Endpoint | Exploitation statusNot exploited | FixNo | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-53636Open edX LTI OAuth Replay Attack | Exploitation statusActively exploited | FixNo | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-53635Open edX Platform: Insufficient Permission on set_course_mode_price() | Exploitation statusActively exploited | FixNo | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-42857Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization | Exploitation statusActively exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-42858Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint | Exploitation statusActively exploited | FixYes | Published05/11/2026 | SeverityHigh |
|---|
CVE-2026-35404Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter | Exploitation statusActively exploited | FixNo | Published04/06/2026 | SeverityMedium |
|---|
CVE-2026-34736Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API | Exploitation statusActively exploited | FixYes | Published04/02/2026 | SeverityMedium |
|---|
9 Results | Page 1 of 1