Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-44282
  • github.com/decidim/decidim
 Election question titles allow stored script execution 15 Sep
  • Fix available
  • Severity - 4.8 (Medium)
GHSA-9mvp-w4rr-5c6x
  • RubyGems/decidim-elections
 decidim-elections: Election question titles allow stored script execution 09 Sep
  • Fix available
  • Severity - 4.8 (Medium)
CVE-2026-45378
  • github.com/decidim/decidim
 Decidim: Verification documents can be downloaded through reusable links 06 Aug
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-45573
  • github.com/decidim/decidim
 Decidim: Push subscriptions can be abused for server-side requests 06 Aug
  • Fix available
  • Severity - 6.4 (Medium)
CVE-2026-45572
  • github.com/decidim/decidim
 Decidim: HTML content blocks allow stored script execution 06 Aug
  • Fix available
  • Severity - 4.8 (Medium)
CVE-2026-45415
  • github.com/decidim/decidim
 Decidim: CSV census record endpoints improper authorization 06 Aug
  • Fix available
  • Severity - 6.0 (Medium)
CVE-2026-45414
  • github.com/decidim/decidim
 Decidim: JWT-backed authentication can be replayed across organizations 06 Aug
  • Fix available
  • Severity - 8.5 (High)
CVE-2026-45377
  • github.com/decidim/decidim
 Decidim: Private exports can be downloaded through reusable links 31 Jul
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-45376
  • github.com/decidim/decidim
 Decidim: Admin user search allows SQL injection through similarity-based sorting 31 Jul
  • Fix available
  • Severity - 5.5 (Medium)
CVE-2026-45330
  • github.com/decidim/decidim
 Decidim: Veriļ¬cation admins can access supplied IDs from other organisations 31 Jul
  • Fix available
  • Severity - 4.9 (Medium)
CVE-2026-45086
  • github.com/decidim/decidim
 Decidim: Forms admin question editor lacks authorization 31 Jul
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-2g9c-vf8h-prxx
  • RubyGems/decidim-core
 Decidim: Push subscriptions can be abused for server-side requests 13 Jul
  • Fix available
  • Severity - 6.4 (Medium)
GHSA-533c-2vh9-4r86
  • RubyGems/decidim-core
 Decidim: HTML content blocks allow stored script execution 13 Jul
  • Fix available
  • Severity - 4.8 (Medium)
GHSA-q79h-67vx-m9xg
  • RubyGems/decidim-verifications
 Decidim: CSV census record endpoints improper authorization 13 Jul
  • Fix available
  • Severity - 6.0 (Medium)
GHSA-r3v7-5x4c-c69q
  • RubyGems/decidim
 Decidim: JWT-backed authentication can be replayed across organizations 13 Jul
  • Fix available
  • Severity - 8.5 (High)
GHSA-3mvf-82qp-8qh5
  • RubyGems/decidim-verifications
 Decidim: Verification documents can be downloaded through reusable links 13 Jul
  • Fix available
  • Severity - 7.5 (High)
Load more...