A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the corecourseget_categories web service to return hidden categories, which should be omitted when fetching course categories.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10890.json"