- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 13 · 1 critical, 7 high, 4 medium, 1 low
- Registry
- RubyGems
Advisories 13
- CVE-2026-45414High 8.5
Decidim: JWT-backed authentication can be replayed across organizations
Affected: fixed in 0.31.5; from 0.32.0.rc1, fixed in 0.32.0.
- CVE-2025-65017High 8.2
Decidim's private data exports can lead to data leaks
Affected: from 0.30.0, fixed in 0.30.4.
- CVE-2024-41673High 7.1
Decidim has a cross-site scripting vulnerability in the version control page
Affected: fixed in 0.27.8.
- CVE-2024-39910Medium 5.4
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
Affected: fixed in 0.27.7.
- CVE-2024-32469High 7.1
Decidim has cross-site scripting (XSS) in the pagination
Affected: fixed in 0.27.6; from 0.28.0.rc1, fixed in 0.28.1.
- CVE-2024-27090Medium 5.3
Decidim vulnerable to data disclosure through the embed feature
Affected: fixed in 0.27.6.
- CVE-2023-51447Medium 6.3
Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads
Affected: from 0.27.0, fixed in 0.27.5.
- CVE-2023-48220Medium 5.7
Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period
Affected: from 0.0.1.alpha3, fixed in 0.26.9; from 0.27.0, fixed in 0.27.5.
- CVE-2023-47634Low 3.1
Decidim has race condition in Endorsements
Affected: from 0.10.0, fixed in 0.26.9; from 0.27.0, fixed in 0.27.5.
- CVE-2023-36465Critical 9.1
Decidim has broken access control in templates
Affected: from 0.23.2, fixed in 0.26.8; from 0.27.0, fixed in 0.27.4.
- CVE-2023-34089High 8.1
Decidim Cross-site Scripting vulnerability in the processes filter
Affected: from 0.14.0, fixed in 0.26.7; from 0.27.0, fixed in 0.27.3.
- CVE-2023-34090High 7.5
Decidim vulnerable to sensitive data disclosure
Affected: from 0.27.0, fixed in 0.27.3.
- CVE-2023-32693High 8.1
Decidim Cross-site Scripting vulnerability in the external link redirections
Affected: from 0.25.0, fixed in 0.26.7; from 0.27.0, fixed in 0.27.3.