openedx records

8 published records for vendor openedx.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 37.5%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-43782No exploit	openedx-translations's Atlas translations for Open edX missing validationopenedx · openedx · CWE-74 Pre-auth	Critical9.8	—	0.5%	Aug 23, 2024
39Monitor	CVE-2026-42858No exploit	Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpointopenedx · openedx · CWE-918 SSRF	Critical9.9	—	0.4%	May 11, 2026
34Monitor	CVE-2026-42860No exploit	Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpointopenedx · edx-enterprise · CWE-918 SSRF	High8.5	—	0.3%	May 11, 2026
24Monitor	CVE-2022-46147No exploit	Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fieldsopenedx · xblock-drag-and-drop-v2 · CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	Nov 28, 2022
24Monitor	CVE-2026-35404No exploit	Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameteropenedx · openedx · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.3%	Apr 6, 2026
21Monitor	CVE-2023-23611No exploit	xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementationopenedx · xblock-lti-consumer · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.4%	Jan 26, 2023
21Monitor	CVE-2024-41806No exploit	Open edX Platform's instructor upload CSV for cohort creation not Private by Defaultopenedx · edx-platform · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.3%	Jul 25, 2024
21Monitor	CVE-2026-42857No exploit	Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitizationopenedx · openedx · CWE-79 XSS	Medium5.4	—	0.3%	May 11, 2026

CVE-2024-43782
39Monitor
openedx-translations's Atlas translations for Open edX missing validation
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
openedx · openedxAug 23, 2024
CVE-2026-42858
39Monitor
Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
CriticalCVSS 9.9No exploitEPSS 0%
- SSRF
openedx · openedxMay 11, 2026
CVE-2026-42860
34Monitor
Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint
HighCVSS 8.5No exploitEPSS 0%
- SSRF
openedx · edx-enterpriseMay 11, 2026
CVE-2022-46147
24Monitor
Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
openedx · xblock-drag-and-drop-v2Nov 28, 2022
CVE-2026-35404
24Monitor
Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- Open redirect
openedx · openedxApr 6, 2026
CVE-2023-23611
21Monitor
xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
openedx · xblock-lti-consumerJan 26, 2023
CVE-2024-41806
21Monitor
Open edX Platform's instructor upload CSV for cohort creation not Private by Default
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
openedx · edx-platformJul 25, 2024
CVE-2026-42857
21Monitor
Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
MediumCVSS 5.4No exploitEPSS 0%
- XSS
openedx · openedxMay 11, 2026