decidim vulnerabilities

CVEs per yearBy the year they were published

1. 20234
2. 202411
3. 202614

Newest CVEs

• CVE-2026-44282

  Election question titles allow stored script execution

  decidim · decidim

  Medium4.8
• CVE-2026-45378

  Decidim: Verification documents can be downloaded through reusable links

  decidim · decidim

  High7.5
• CVE-2026-45573

  Decidim: Push subscriptions can be abused for server-side requests

  decidim · decidim

  Medium6.4
• CVE-2026-45572

  Decidim: HTML content blocks allow stored script execution

  decidim · decidim

  Medium4.8
• CVE-2026-45415

  Decidim: CSV census record endpoints improper authorization

  decidim · decidim

  Medium6.0
• CVE-2026-45414

  Decidim: JWT-backed authentication can be replayed across organizations

  decidim · decidim

  High8.5
• CVE-2026-45377

  Decidim: Private exports can be downloaded through reusable links

  decidim · decidim

  Medium6.5
• CVE-2026-45376

  Decidim: Admin user search allows SQL injection through similarity-based sorting

  decidim · decidim

  Medium5.5
• CVE-2026-45330

  Decidim: Verification admins can access supplied IDs from other organisations

  decidim · decidim

  Medium4.9
• CVE-2026-45086

  Decidim: Forms admin question editor lacks authorization

  decidim · decidim

  Medium5.4