Ddecidim

Products

Exploited and recent CVEs

• CVE-2026-44282 Medium 4.8 Election question titles allow stored script execution 0.4%
• CVE-2026-45378 High 7.5 Decidim: Verification documents can be downloaded through reusable links 0.4%
• CVE-2026-45573 Medium 6.4 Decidim: Push subscriptions can be abused for server-side requests 0.3%
• CVE-2026-45572 Medium 4.8 Decidim: HTML content blocks allow stored script execution 0.3%
• CVE-2026-45415 Medium 6.0 Decidim: CSV census record endpoints improper authorization 0.4%
• CVE-2026-45414 High 8.5 Decidim: JWT-backed authentication can be replayed across organizations 0.5%
• CVE-2026-45377 Medium 6.5 Decidim: Private exports can be downloaded through reusable links 0.5%
• CVE-2026-45376 Medium 5.5 Decidim: Admin user search allows SQL injection through similarity-based sorting 0.6%
• CVE-2026-45330 Medium 4.9 Decidim: Verification admins can access supplied IDs from other organisations 0.5%
• CVE-2026-45086 Medium 5.4 Decidim: Forms admin question editor lacks authorization 0.3%
• CVE-2026-40869 High 7.5 Decidim amendments can be accepted or rejected by anyone 0.2%
• CVE-2026-40870 High 7.5 Decidim's comments API allows access to all commentable resources 0.3%
• CVE-2026-23891 Critical 9.3 Decidim has a Cross-site scripting (XSS) vulnerability via user name field 0.4%
• CVE-2025-65017 High 8.2 Decidim's private data exports can lead to data leaks 0.3%
• CVE-2024-45594 High 7.7 Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds 0.3%
• CVE-2024-41673 High 7.1 Decidim has a cross-site scripting vulnerability in the version control page 0.4%
• CVE-2024-39910 Medium 5.4 Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor 0.3%
• CVE-2024-32034 Medium 6.8 Cross-site scripting (XSS) in the decidim admin activity log 0.4%
• CVE-2024-32469 High 7.1 Decidim has cross-site scripting (XSS) in the pagination 0.4%
• CVE-2024-27095 Medium 5.4 Decidim cross-site scripting (XSS) in the admin panel 0.3%
• CVE-2024-27090 Medium 5.3 Decidim vulnerable to data disclosure through the embed feature 0.5%
• CVE-2023-51447 Medium 6.3 Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads 0.5%
• CVE-2023-48220 Medium 5.7 Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period 0.8%
• CVE-2023-47635 Medium 4.5 Decidim vulnerable to possible CSRF attack at questionnaire templates preview 0.3%
• CVE-2023-47634 Low 3.1 Decidim has race condition in Endorsements 0.4%
• CVE-2023-36465 Critical 9.1 Decidim has broken access control in templates 0.7%
• CVE-2023-34089 High 8.1 Decidim Cross-site Scripting vulnerability in the processes filter 0.7%
• CVE-2023-34090 High 7.5 Decidim vulnerable to sensitive data disclosure 1.3%
• CVE-2023-32693 High 8.1 Decidim Cross-site Scripting vulnerability in the external link redirections 0.8%