Moodle version check
Enter the Moodle version your site runs and see every security advisory Moodle has published for it since, with the release that fixes each one.
Find it under Site administration, then Notifications, or in version.php at the root of your Moodle install. The list covers every Moodle release from 3.0.
Supported branches
Branches still receiving security fixes, and their current release.
5.2Latest release 5.2.3, 14 Sep 2026
Security support ends 4 Oct 2027
Security support ends 4 Oct 2027
5.1Latest release 5.1.7, 14 Sep 2026
Security support ends 19 Apr 2027
Security support ends 19 Apr 2027
5.0Latest release 5.0.10, 14 Sep 2026
Security support ends 5 Oct 2026
Security support ends 5 Oct 2026
4.5Latest release 4.5.14, 14 Sep 2026
Security support ends 4 Oct 2027LTS
Security support ends 4 Oct 2027LTS
Latest advisories
Newest security announcements from Moodle.
Serious
CSRF risk in XML grade imports
MSA-26-0041 · Fixed in 5.2.2, 5.1.6, 5.0.9, 4.5.13 · Published 9 Sep 2026
Minor
User list filters do not respect user profile field visibility
MSA-26-0040 · Fixed in 5.2.2, 5.1.6, 5.0.9, 4.5.13 · Published 9 Sep 2026
Minor
Minor XSS risk via password reset link
MSA-26-0039 · Fixed in 5.2.2, 5.1.6, 5.0.9, 4.5.13 · Published 9 Sep 2026
Minor
Enrolling user to course while selecting group does not validate group belongs to that course
MSA-26-0038 · Fixed in 5.2.2, 5.1.6 · Published 9 Sep 2026
Minor
Missing capability checks allow unauthorised triggering of grade penalty recalculation
MSA-26-0037 · Fixed in 5.2.2, 5.1.6, 5.0.9 · Published 9 Sep 2026
Minor
Incorrect capability check in AI editor placement "generate image" service
MSA-26-0036 · Fixed in 5.2.2, 5.1.6, 5.0.9, 4.5.13 · Published 9 Sep 2026
Moodle core is one half of the picture
Third-party plugins run with the same privileges as core and never appear in these advisories. MDL Shield reviews plugin code for exactly that gap.
Advisory titles and descriptions are Moodle's own words, from the security announcements on moodle.org, and every entry links to its source. This list is a lower bound: Moodle stops issuing advisories for a branch once it leaves security support. MDL Shield is an independent service and is not affiliated with or endorsed by Moodle Pty Ltd.