Moodle version check
Enter the Moodle version your site runs and see every security advisory Moodle has published for it since, with the release that fixes each one.
Find it under Site administration, then Notifications, or in version.php at the root of your Moodle install. The list covers every Moodle release from 3.0.
Supported branches
Branches still receiving security fixes, and their current release.
5.3Latest release 5.3.0, 5 Oct 2026
Security support ends 1 Oct 2029LTS
Security support ends 1 Oct 2029LTS
5.2Latest release 5.2.4, 5 Oct 2026
Security support ends 4 Oct 2027
Security support ends 4 Oct 2027
5.1Latest release 5.1.8, 5 Oct 2026
Security support ends 19 Apr 2027
Security support ends 19 Apr 2027
4.5Latest release 4.5.15, 5 Oct 2026
Security support ends 4 Oct 2027LTS
Security support ends 4 Oct 2027LTS
Latest advisories
Newest security announcements from Moodle.
Minor
Upgrade TinyMCE and PrismJS including security fixes (upstream)
MSA-26-0045 · Fixed in 5.2.4 · Published 15 Oct 2026
Serious
Missing access checks on H5P content files
MSA-26-0044 · Fixed in 5.2.4, 5.1.8, 5.0.11, 4.5.15 · Published 15 Oct 2026
Minor
Possible to bypass the login notification mechanism
MSA-26-0043 · Fixed in 5.2.3, 5.1.7, 5.0.10, 4.5.14 · Published 22 Sep 2026
Serious
Blind SQL injection risk in profile availability condition check
MSA-26-0042 · Fixed in 5.2.3, 5.1.7, 5.0.10, 4.5.14 · Published 22 Sep 2026
Serious
CSRF risk in XML grade imports
MSA-26-0041 · Fixed in 5.2.2, 5.1.6, 5.0.9, 4.5.13 · Published 9 Sep 2026
Minor
User list filters do not respect user profile field visibility
MSA-26-0040 · Fixed in 5.2.2, 5.1.6, 5.0.9, 4.5.13 · Published 9 Sep 2026
Moodle core is one half of the picture
Third-party plugins run with the same privileges as core and never appear in these advisories. MDL Shield reviews plugin code for exactly that gap.
Advisory titles and descriptions are Moodle's own words, from the security announcements on moodle.org, and every entry links to its source. This list is a lower bound: Moodle stops issuing advisories for a branch once it leaves security support. MDL Shield is an independent service and is not affiliated with or endorsed by Moodle Pty Ltd.