CVE-2026-45573 | Medium | 6.4 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled… |
CVE-2026-45572 | Medium | 4.8 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-… |
CVE-2026-45415 | Medium | 6.0 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_l… |
CVE-2026-45414 | High | 8.5 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organiza… |
CVE-2026-45378 | High | 7.5 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verifica… |
CVE-2026-45377 | Medium | 6.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data… |
CVE-2026-45376 | Medium | 5.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/us… |
CVE-2026-45330 | Medium | 4.9 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verifica… |
CVE-2026-45086 | Medium | 5.4 | 2026-07-31 | Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demograph… |
CVE-2026-40870 | High | 7.5 | 2026-04-21 | Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level `commentable` field in the AP… |
CVE-2026-40869 | High | 7.5 | 2026-04-21 | Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and a… |
CVE-2026-23891 | High | 8.7 | 2026-04-13 | Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name… |
CVE-2025-65017 | Medium | 6.5 | 2026-02-03 | Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lea… |
CVE-2024-45594 | High | 7.7 | 2024-11-13 | Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a m… |
CVE-2024-41673 | High | 7.1 | 2024-10-01 | Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This… |
CVE-2024-39910 | Medium | 5.4 | 2024-09-16 | decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is sub… |
CVE-2024-32034 | Medium | 6.8 | 2024-09-16 | decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to po… |
CVE-2024-32469 | High | 7.1 | 2024-07-10 | Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL… |
CVE-2024-27095 | Medium | 5.4 | 2024-07-10 | Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being up… |
CVE-2024-27090 | Medium | 5.3 | 2024-07-10 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-47634 | Low | 3.1 | 2024-02-29 | Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsemen… |
CVE-2023-51447 | Medium | 6.3 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject… |
CVE-2023-48220 | Medium | 5.7 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allow… |
CVE-2023-47635 | Medium | 4.5 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabl… |
CVE-2023-36465 | Critical | 9.1 | 2023-10-06 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-34090 | High | 7.5 | 2023-07-11 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-34089 | High | 8.1 | 2023-07-11 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-32693 | High | 8.1 | 2023-07-11 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |