Decidim

This hub aggregates every CVE we track for Decidim, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Decidim.

• CVE-2026-45378Decidim: Verification documents can be downloaded through reusable links7.5Aug 6, 2026
• CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requests6.4Aug 6, 2026
• CVE-2026-45572Decidim: HTML content blocks allow stored script execution4.8Aug 6, 2026
• CVE-2026-45415Decidim: CSV census record endpoints improper authorization6.0Aug 6, 2026
• CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizations8.5Aug 6, 2026
• CVE-2026-45377Decidim: Private exports can be downloaded through reusable links6.5Jul 31, 2026
• CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sorting5.5Jul 31, 2026
• CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisations4.9Jul 31, 2026
• CVE-2026-45086Decidim: Forms admin question editor lacks authorization5.4Jul 31, 2026
• CVE-2026-40869Decidim amendments can be accepted or rejected by anyone7.5Apr 21, 2026
• CVE-2026-40870Decidim's comments API allows access to all commentable resources7.5Apr 21, 2026
• CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name field8.7Apr 13, 2026
• CVE-2025-65017Decidim's private data exports can lead to data leaks6.5Feb 3, 2026
• CVE-2024-45594Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds7.7Nov 13, 2024
• CVE-2024-41673Decidim has a cross-site scripting vulnerability in the version control page7.1Oct 1, 2024