openedx-platform — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in openedx-platform, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-85271	Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) CWE-79	6.1	Medium	2026-09-18
CVE-2026-85272	Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation CWE-22	4.3	Medium	2026-09-18
CVE-2026-55421	Open edX Platform: SSRF in Studio Video Download Endpoint CWE-918	6.8	Medium	2026-09-02
CVE-2026-53636	Open edX LTI OAuth Replay Attack CWE-294	4.7	Medium	2026-09-02
CVE-2026-53635	Open edX Platform: Insufficient Permission on set_course_mode_price() CWE-862	7.6	High	2026-09-02
CVE-2026-42857	Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization CWE-79	4.6	Medium	2026-05-11
CVE-2026-42858	Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CWE-918	8.5	High	2026-05-11
CVE-2026-35404	Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CWE-601	4.7	Medium	2026-04-06
CVE-2026-34736	Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CWE-287	5.3	Medium	2026-04-02

All 9 known CVE vulnerabilities affecting openedx-platform with full Chinese analysis, references, and POCs where available.