decidim records
16 published records for vendor decidim.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor3
- CWE-284 Improper Access Control1
- CWE-672 Operation on a Resource after Expiration or Release1
- CWE-918 Server-Side Request Forgery (SSRF)1
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
16 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
37Monitor | CVE-2026-23891No exploit | Decidim has a Cross-site scripting (XSS) vulnerability via user name fielddecidim · decidim · CWE-79 | Critical9.3 | — | 0.4% | Apr 13, 2026 |
32Monitor | CVE-2025-65017No exploit | Decidim's private data exports can lead to data leaksdecidim · decidim · CWE-200 | High8.2 | — | 0.3% | Feb 3, 2026 |
30Monitor | CVE-2023-34090No exploit | Decidim vulnerable to sensitive data disclosuredecidim · decidim · CWE-200 | High7.5 | — | 1.3% | Jul 11, 2023 |
29Monitor | CVE-2023-48220No exploit | Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry perioddecidim · decidim · CWE-672 | High7.4 | — | 0.8% | Feb 20, 2024 |
28Monitor | CVE-2023-36465No exploit | Decidim has broken access control in templatesdecidim · decidim · CWE-284 | High7.1 | — | 0.5% | Oct 6, 2023 |
26Monitor | CVE-2026-40869No exploit | Decidim amendments can be accepted or rejected by anyonedecidim · decidim · CWE-266 | Medium6.5 | — | 0.3% | Apr 21, 2026 |
24Monitor | CVE-2023-32693No exploit | Decidim Cross-site Scripting vulnerability in the external link redirectionsdecidim · decidim · CWE-79 | Medium6.1 | — | 0.8% | Jul 11, 2023 |
24Monitor | CVE-2023-34089No exploit | Decidim Cross-site Scripting vulnerability in the processes filterdecidim · decidim · CWE-79 | Medium6.1 | — | 0.7% | Jul 11, 2023 |
22Monitor | CVE-2023-47635No exploit | Decidim vulnerable to possible CSRF attack at questionnaire templates previewdecidim · decidim · CWE-918 | Medium5.7 | — | 0.3% | Feb 20, 2024 |
21Monitor | CVE-2023-51447No exploit | Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploadsdecidim · decidim · CWE-79 | Medium5.4 | — | 0.5% | Feb 20, 2024 |
21Monitor | CVE-2024-27090No exploit | Decidim vulnerable to data disclosure through the embed featuredecidim · decidim · CWE-200 | Medium5.3 | — | 0.5% | Jul 10, 2024 |
21Monitor | CVE-2024-45594No exploit | Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embedsdecidim · decidim · CWE-79 | Medium5.4 | — | 0.2% | Nov 13, 2024 |
19Monitor | CVE-2024-32034No exploit | Cross-site scripting (XSS) in the decidim admin activity logdecidim · decidim · CWE-79 | Medium4.8 | — | 0.4% | Sep 16, 2024 |
19Monitor | CVE-2024-27095No exploit | Decidim cross-site scripting (XSS) in the admin paneldecidim · decidim · CWE-79 | Medium4.8 | — | 0.3% | Jul 10, 2024 |
19Monitor | CVE-2024-39910No exploit | Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editordecidim · decidim · CWE-79 | Medium4.8 | — | 0.3% | Sep 16, 2024 |
12Monitor | CVE-2023-47634No exploit | Decidim has race condition in Endorsementsdecidim · decidim · CWE-362 | Low3.1 | — | 0.4% | Feb 28, 2024 |
- CVE-2026-2389137Monitor
Decidim has a Cross-site scripting (XSS) vulnerability via user name field
CriticalCVSS 9.3No exploitEPSS 0%decidim · decidimApr 13, 2026
- CVE-2025-6501732Monitor
Decidim's private data exports can lead to data leaks
HighCVSS 8.2No exploitEPSS 0%decidim · decidimFeb 3, 2026
- CVE-2023-3409030Monitor
Decidim vulnerable to sensitive data disclosure
HighCVSS 7.5No exploitEPSS 1%decidim · decidimJul 11, 2023
- CVE-2023-4822029Monitor
Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period
HighCVSS 7.4No exploitEPSS 1%decidim · decidimFeb 20, 2024
- CVE-2023-3646528Monitor
Decidim has broken access control in templates
HighCVSS 7.1No exploitEPSS 1%decidim · decidimOct 6, 2023
- CVE-2026-4086926Monitor
Decidim amendments can be accepted or rejected by anyone
MediumCVSS 6.5No exploitEPSS 0%decidim · decidimApr 21, 2026
- CVE-2023-3269324Monitor
Decidim Cross-site Scripting vulnerability in the external link redirections
MediumCVSS 6.1No exploitEPSS 1%decidim · decidimJul 11, 2023
- CVE-2023-3408924Monitor
Decidim Cross-site Scripting vulnerability in the processes filter
MediumCVSS 6.1No exploitEPSS 1%decidim · decidimJul 11, 2023
- CVE-2023-4763522Monitor
Decidim vulnerable to possible CSRF attack at questionnaire templates preview
MediumCVSS 5.7No exploitEPSS 0%decidim · decidimFeb 20, 2024
- CVE-2023-5144721Monitor
Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads
MediumCVSS 5.4No exploitEPSS 0%decidim · decidimFeb 20, 2024
- CVE-2024-2709021Monitor
Decidim vulnerable to data disclosure through the embed feature
MediumCVSS 5.3No exploitEPSS 0%decidim · decidimJul 10, 2024
- CVE-2024-4559421Monitor
Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds
MediumCVSS 5.4No exploitEPSS 0%decidim · decidimNov 13, 2024
- CVE-2024-3203419Monitor
Cross-site scripting (XSS) in the decidim admin activity log
MediumCVSS 4.8No exploitEPSS 0%decidim · decidimSep 16, 2024
- CVE-2024-2709519Monitor
Decidim cross-site scripting (XSS) in the admin panel
MediumCVSS 4.8No exploitEPSS 0%decidim · decidimJul 10, 2024
- CVE-2024-3991019Monitor
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
MediumCVSS 4.8No exploitEPSS 0%decidim · decidimSep 16, 2024
- CVE-2023-4763412Monitor
Decidim has race condition in Endorsements
LowCVSS 3.1No exploitEPSS 0%decidim · decidimFeb 28, 2024