CVE Tools
Track your stack

Moodle

646 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Moodle, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Moodle CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Moodle CVEs per month
MonthCVEs
2024-121
2025-010
2025-029
2025-030
2025-0417
2025-050
2025-061
2025-070
2025-082
2025-091
2025-109
2025-110
2025-120
2026-012
2026-0212
2026-031
2026-040
2026-051
2026-060
2026-070
2026-080
2026-0912
2026-104
2026-110

Severity

How the 646 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical234%
  • High9815%
  • Medium47373%
  • Low528%

Latest CVEs

The 15 most recently published vulnerabilities affecting Moodle.

  1. CVE-2026-119556Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems4.3
  2. CVE-2026-119555Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback4.3
  3. CVE-2026-119553Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal6.5
  4. CVE-2026-119554Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber5.9
  5. CVE-2026-102588Moodle: csrf in xml grade import6.5
  6. CVE-2026-102587Moodle: user list filters bypass profile field visibility2.7
  7. CVE-2026-102586Moodle: xss via password reset link due to insufficient username escaping4.3
  8. CVE-2026-102585Moodle: group validation missing when enrolling user to course4.3
  9. CVE-2026-102584Moodle: missing capability check allows unauthorised grade penalty recalculation4.3
  10. CVE-2026-102583Moodle: incorrect capability check in ai generate image web service2.7
  11. CVE-2026-102582Moodle: manual enrolment page accessible when plugin disabled2.2
  12. CVE-2026-102581Moodle: xss in forum post templates due to insufficient escaping4.6
  13. CVE-2026-102580Moodle: arbitrary class instantiation via report builder audience classname2.2
  14. CVE-2026-102579Moodle: user profile information disclosure via grade web service4.3
  15. CVE-2026-102578Moodle: sql injection in question bank web service5.5

Product grouping is registry-driven, with AI assist and human review. How it works