[ Vendor · 12 CVEs ]
Moodle
CVEs affecting Moodle published in the last 30 days, plus any Moodle CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-102587 | 30 Sep 2026 | CVSS 2.7 | moodleA flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager… | Fix |
| CVE-2026-102588 | 30 Sep 2026 | CVSS 6.5 | moodleA flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an… | Fix |
| CVE-2026-102580 | 30 Sep 2026 | CVSS 4.3 | moodleA flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component… | Fix |
| CVE-2026-102581 | 30 Sep 2026 | CVSS 5.4 | moodleA flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS)… | Fix |
| CVE-2026-102582 | 30 Sep 2026 | CVSS 4.3 | moodleA flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing… | Fix |
| CVE-2026-102583 | 30 Sep 2026 | CVSS 2.7 | moodleA flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows… | Fix |
| CVE-2026-102584 | 30 Sep 2026 | CVSS 4.3 | moodleA flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties… | Fix |
| CVE-2026-102585 | 30 Sep 2026 | CVSS 4.3 | moodleA flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected… | Fix |
| CVE-2026-102586 | 30 Sep 2026 | CVSS 6.1 | moodleA flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site… | Fix |
| CVE-2026-102577 | 30 Sep 2026 | CVSS 4.3 | moodleA flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated… | Fix |
| CVE-2026-102578 | 30 Sep 2026 | CVSS 8.8 | moodleA flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into… | Fix |
| CVE-2026-102579 | 30 Sep 2026 | CVSS 4.3 | moodleA flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of… | Fix |