# cve.now: Decidim The newest entries naming Decidim as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-44282](https://cve.now/CVE-2026-44282.md): Election question titles allow stored script execution (CVSS 4.8) - [CVE-2026-45378](https://cve.now/CVE-2026-45378.md): Decidim: Verification documents can be downloaded through reusable links (CVSS 7.5) - [CVE-2026-45573](https://cve.now/CVE-2026-45573.md): Decidim: Push subscriptions can be abused for server-side requests (CVSS 6.4) - [CVE-2026-45572](https://cve.now/CVE-2026-45572.md): Decidim: HTML content blocks allow stored script execution (CVSS 4.8) - [CVE-2026-45415](https://cve.now/CVE-2026-45415.md): Decidim: CSV census record endpoints improper authorization (CVSS 6.0) - [CVE-2026-45414](https://cve.now/CVE-2026-45414.md): Decidim: JWT-backed authentication can be replayed across organizations (CVSS 8.5) - [CVE-2026-45377](https://cve.now/CVE-2026-45377.md): Decidim: Private exports can be downloaded through reusable links (CVSS 6.5) - [CVE-2026-45376](https://cve.now/CVE-2026-45376.md): Decidim: Admin user search allows SQL injection through similarity-based sorting (CVSS 5.5) - [CVE-2026-45330](https://cve.now/CVE-2026-45330.md): Decidim: Veriļ¬cation admins can access supplied IDs from other organisations (CVSS 4.9) - [CVE-2026-45086](https://cve.now/CVE-2026-45086.md): Decidim: Forms admin question editor lacks authorization (CVSS 5.4) - [CVE-2026-40869](https://cve.now/CVE-2026-40869.md): Decidim amendments can be accepted or rejected by anyone (CVSS 7.5) - [CVE-2026-40870](https://cve.now/CVE-2026-40870.md): Decidim's comments API allows access to all commentable resources (CVSS 7.5) - [CVE-2026-23891](https://cve.now/CVE-2026-23891.md): Decidim has a Cross-site scripting (XSS) vulnerability via user name field (CVSS 9.3) - [CVE-2025-65017](https://cve.now/CVE-2025-65017.md): Decidim's private data exports can lead to data leaks (CVSS 8.2) - [CVE-2024-45594](https://cve.now/CVE-2024-45594.md): Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds (CVSS 7.7) - [CVE-2024-41673](https://cve.now/CVE-2024-41673.md): Decidim has a cross-site scripting vulnerability in the version control page (CVSS 7.1) - [CVE-2024-39910](https://cve.now/CVE-2024-39910.md): Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor (CVSS 5.4) - [CVE-2024-32034](https://cve.now/CVE-2024-32034.md): Cross-site scripting (XSS) in the decidim admin activity log (CVSS 6.8) - [CVE-2024-32469](https://cve.now/CVE-2024-32469.md): Decidim has cross-site scripting (XSS) in the pagination (CVSS 7.1) - [CVE-2024-27095](https://cve.now/CVE-2024-27095.md): Decidim cross-site scripting (XSS) in the admin panel (CVSS 5.4) - [CVE-2024-27090](https://cve.now/CVE-2024-27090.md): Decidim vulnerable to data disclosure through the embed feature (CVSS 5.3) - [CVE-2023-51447](https://cve.now/CVE-2023-51447.md): Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads (CVSS 6.3) - [CVE-2023-48220](https://cve.now/CVE-2023-48220.md): Decidim's devise\_invitable gem vulnerable to circumvention of invitation token expiry period (CVSS 5.7) - [CVE-2023-47635](https://cve.now/CVE-2023-47635.md): Decidim vulnerable to possible CSRF attack at questionnaire templates preview (CVSS 4.5) - [CVE-2023-47634](https://cve.now/CVE-2023-47634.md): Decidim has race condition in Endorsements (CVSS 3.1) - [CVE-2023-36465](https://cve.now/CVE-2023-36465.md): Decidim has broken access control in templates (CVSS 9.1) - [CVE-2023-34089](https://cve.now/CVE-2023-34089.md): Decidim Cross-site Scripting vulnerability in the processes filter (CVSS 8.1) - [CVE-2023-34090](https://cve.now/CVE-2023-34090.md): Decidim vulnerable to sensitive data disclosure (CVSS 7.5) - [CVE-2023-32693](https://cve.now/CVE-2023-32693.md): Decidim Cross-site Scripting vulnerability in the external link redirections (CVSS 8.1) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/decidim Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.