MEDIUM6.4RubyGems
GHSA-2g9c-vf8h-prxx· CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requests
Modified: 7/13/2026
package
RubyGems/decidim-core
pkg:rubygems/decidim-core
HIGHRubyGems
GHSA-3cx6-j9j4-54mp· CVE-2025-65017Decidim's private data exports can lead to data leaks
Modified: 2/8/2026
MEDIUM6.1RubyGems
GHSA-469h-mqg8-535r· CVE-2023-32693Decidim Cross-site Scripting vulnerability in the external link redirections
Modified: 9/10/2026
MEDIUM4.8RubyGems
GHSA-533c-2vh9-4r86· CVE-2026-45572Decidim: HTML content blocks allow stored script execution
Modified: 7/13/2026
HIGH8.1RubyGems
GHSA-5652-92r9-3fx9· CVE-2023-34089Decidim Cross-site Scripting vulnerability in the processes filter
Modified: 9/10/2026
MEDIUM6.5RubyGems
GHSA-767h-63j4-5226· CVE-2026-45377Decidim: Private exports can be downloaded through reusable links
Modified: 7/13/2026
MEDIUM6.3RubyGems
GHSA-9w99-78rj-hmxq· CVE-2023-51447Cross-site scripting (XSS) in the dynamic file uploads
Modified: 2/20/2024
HIGH8.7RubyGems
GHSA-fc46-r95f-hq7g· CVE-2026-23891Decidim has a cross-site scripting (XSS) in user name
Modified: 5/13/2026
HIGH7.5RubyGems
GHSA-w5xj-99cg-rccm· CVE-2026-40869Decidim amendments can be accepted or rejected by anyone
Modified: 5/29/2026