- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 1 critical, 4 high, 4 medium
- Registry
- RubyGems
Advisories 9
- CVE-2026-45573Medium 6.4
Decidim: Push subscriptions can be abused for server-side requests
Affected: fixed in 0.30.9; from 0.31.0.rc1, fixed in 0.31.5; from 0.32.0.rc1, fixed in 0.32.0.
- CVE-2026-45572Medium 4.8
Decidim: HTML content blocks allow stored script execution
Affected: fixed in 0.30.9; from 0.31.0.rc1, fixed in 0.31.5; from 0.32.0.rc1, fixed in 0.32.0.
- CVE-2026-45377Medium 6.5
Decidim: Private exports can be downloaded through reusable links
Affected: fixed in 0.30.9; from 0.31.0.rc1, fixed in 0.31.5; from 0.32.0.rc1, fixed in 0.32.0.
- CVE-2026-40869High 7.5
Decidim amendments can be accepted or rejected by anyone
Affected: from 0.31.0.rc1, fixed in 0.31.1; from 0.19.0, fixed in 0.30.5.
- CVE-2026-23891Critical 9.3
Decidim has a Cross-site scripting (XSS) vulnerability via user name field
Affected: from 0.31.0.rc1, fixed in 0.31.1; fixed in 0.30.5.
- CVE-2025-65017High 8.2
Decidim's private data exports can lead to data leaks
Affected: from 0.30.0, fixed in 0.30.4.
- CVE-2023-51447Medium 6.3
Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads
Affected: from 0.27.0, fixed in 0.27.5.
- CVE-2023-34089High 8.1
Decidim Cross-site Scripting vulnerability in the processes filter
Affected: from 0.14.0, fixed in 0.26.7; from 0.27.0, fixed in 0.27.3.
- CVE-2023-32693High 8.1
Decidim Cross-site Scripting vulnerability in the external link redirections
Affected: from 0.27.0, fixed in 0.27.3; from 0.25.0, fixed in 0.26.7.