HIGHRubyGems
GHSA-3cx6-j9j4-54mp· CVE-2025-65017Decidim's private data exports can lead to data leaks
Modified: 2/8/2026
package
RubyGems/decidim
pkg:rubygems/decidim
MEDIUM6.1RubyGems
GHSA-469h-mqg8-535r· CVE-2023-32693Decidim Cross-site Scripting vulnerability in the external link redirections
Modified: 9/10/2026
HIGH8.1RubyGems
GHSA-5652-92r9-3fx9· CVE-2023-34089Decidim Cross-site Scripting vulnerability in the processes filter
Modified: 9/10/2026
HIGH7.1RubyGems
GHSA-639h-86hw-qcjq· CVE-2023-36465Decidim has broken access control in templates
Modified: 9/10/2026
HIGH7.1RubyGems
GHSA-7cx8-44pc-xv3q· CVE-2024-32469Decidim cross-site scripting (XSS) in the pagination
Modified: 9/10/2026
MEDIUM6.3RubyGems
GHSA-9w99-78rj-hmxq· CVE-2023-51447Cross-site scripting (XSS) in the dynamic file uploads
Modified: 2/20/2024
HIGH7.1RubyGems
GHSA-cc4g-m3g7-xmw8· CVE-2024-41673Decidim has a cross-site scripting vulnerability in the version control page
Modified: 10/3/2024
HIGH7.5RubyGems
GHSA-jm79-9pm4-vrw9· CVE-2023-34090Decidim vulnerable to sensitive data disclosure
Modified: 7/8/2026
MEDIUM5.3RubyGems
GHSA-qcj6-vxwx-4rqv· CVE-2024-27090Decidim vulnerable to data disclosure through the embed feature
Modified: 9/10/2026
LOW3.1RubyGems
GHSA-r275-j57c-7mf2· CVE-2023-47634Race condition in Endorsements
Modified: 9/10/2026
HIGH8.5RubyGems
GHSA-r3v7-5x4c-c69q· CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizations
Modified: 7/13/2026
MEDIUM5.4RubyGems
GHSA-vvqw-fqwx-mqmm· CVE-2024-39910Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor
Modified: 9/17/2024
MEDIUM5.7RubyGems
GHSA-w3q8-m492-4pwp· CVE-2023-48220Possibility to circumvent the invitation token expiry period
Modified: 9/10/2026