PatchTheCVE: openedxhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-42860: The Open edx Enterprise Service app provides enterprise features to the Open edX platformhttps://patchthecve.com/cve/CVE-2026-42860.htmlhttps://patchthecve.com/cve/CVE-2026-42860.htmlMon, 26 Oct 2026 18:10:00 +0000HIGH 8.5: The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin roCVE-2026-42858: Open edX Platform enables the authoring and delivery of online learning at any scalehttps://patchthecve.com/cve/CVE-2026-42858.htmlhttps://patchthecve.com/cve/CVE-2026-42858.htmlMon, 26 Oct 2026 18:10:00 +0000HIGH 8.5: Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() iCVE-2026-42857: Open edX Platform enables the authoring and delivery of online learning at any scalehttps://patchthecve.com/cve/CVE-2026-42857.htmlhttps://patchthecve.com/cve/CVE-2026-42857.htmlMon, 26 Oct 2026 18:10:00 +0000MEDIUM 4.6: Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template fi