Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Sep 18, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-85272 · Other software · openedx · reported by GitHubMedium 4.3
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-85271 · Other software · openedx · reported by GitHubMedium 6.1
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-55421 · Other software · openedx · reported by GitHubMedium 6.8
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-53636 · Other software · openedx · reported by GitHubMedium 4.7
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-53635 · Other software · openedx · reported by GitHubHigh 7.6
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-42858 · Other software · openedx · reported by GitHubHigh 8.5
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-42857 · Other software · openedx · reported by GitHubMedium 4.6
Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-35404 · Other software · openedx · reported by GitHubMedium 4.7
Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-34736 · Other software · openedx · reported by GitHubMedium 5.3
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025The Open edX Platform is a learning management platform.CVE-2025-68270 · Other software · openedx · reported by GitHubCritical 9.9
The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.
- Product
- edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025The Open edX Platform is a learning management platform.CVE-2025-47942 · Other software · openedx · reported by GitHubMedium 5.3
The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers.
- Product
- edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2024The Open edX Platform is a learning management platform.CVE-2024-41806 · Other software · openedx · reported by GitHubMedium 5.3
The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access.
- Product
- edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2024Open edX Platform is a service-oriented platform for authoring and delivering online learning.CVE-2024-22209 · Other software · openedx · reported by GitHubMedium 6.4
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.
- Product
- edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2021Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.CVE-2021-39248 · Other software · EDX · reported by MITREMedium 6.1
Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2019edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.CVE-2018-20859 · Other software · EDX · reported by MITREMedium 6.1
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Jul 30, 2019The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.CVE-2017-18381 · Other software · EDX · reported by MITREHigh 7.2
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
Jul 30, 2019edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.CVE-2017-18380 · Other software · EDX · reported by MITREHigh 7.5
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Jul 29, 2019edx-platform before 2016-06-06 allows CSRF.CVE-2016-10766 · Other software · EDX · reported by MITREHigh 8.8
edx-platform before 2016-06-06 allows CSRF.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopen.edx.org
Jul 29, 2019edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.CVE-2016-10765 · Other software · EDX · reported by MITREMedium 5.3
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen.edx.orgopen.edx.org
Jul 29, 2019edx-platform before 2015-09-17 allows XSS via a team name.CVE-2015-6960 · Other software · EDX · reported by MITREMedium 6.1
edx-platform before 2015-09-17 allows XSS via a team name.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen.edx.orgopen.edx.org
Jul 29, 2019edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.CVE-2015-6253 · Other software · EDX · reported by MITREMedium 5.4
edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen.edx.orgopen.edx.org
Jul 29, 2019edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.CVE-2015-5601 · Other software · EDX · reported by MITREHigh 8.8
edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen.edx.orgopen.edx.org
Mar 13, 2017Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to oCVE-2015-6671 · Other software · EDX · reported by MITREMedium 5.9
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.
- Product
- Edx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopen.edx.org
Mar 19, 2016lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assiCVE-2015-2286 · Other software · EDX · reported by MITREMedium 6.5
lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
- Product
- Open EDX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopen.edx.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.