openedx-platform

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path ValidationCVE-2026-85272openedx · CVSS 4.3 · 0.5% likely

   CWE-22

2. Open edX Platform: SSRF in Studio Video Download EndpointCVE-2026-55421openedx · CVSS 6.8 · 0.5% likely

   CWE-918

3. Open edX Platform: Insufficient Permission on set_course_mode_price()CVE-2026-53635openedx · CVSS 7.6 · 0.4% likely

   CWE-862

4. Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync EndpointCVE-2026-42858openedx · CVSS 8.5 · 0.4% likely

   CWE-918

5. Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)CVE-2026-85271openedx · CVSS 6.1 · 0.4% likely

   CWE-79

6. Open edX LTI OAuth Replay AttackCVE-2026-53636openedx · CVSS 4.7 · 0.3% likely

   CWE-294

7. Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforceCVE-2026-97702openedx · CVSS 5.3 · 0.3% likely

   CWE-204

8. Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url ParameterCVE-2026-35404openedx · CVSS 4.7 · 0.2% likely

   CWE-601

9. Open edX Platform: Account Activation Bypass via activation_key Exposure in REST APICVE-2026-34736openedx · CVSS 5.3 · 0.2% likely

   CWE-287

10. Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML SanitizationCVE-2026-42857openedx · CVSS 4.6 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.