Decidim
7 CVEs tracked since 2023. Since Jul 2023, none of them reached CISA KEV.
Decidim CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2023-07 | 3 | 0 |
| 2023-08 | null or fewer | |
| 2023-09 | null or fewer | |
| 2023-10 | null or fewer | |
| 2023-11 | null or fewer | |
| 2023-12 | null or fewer | |
| 2024-01 | null or fewer | |
| 2024-02 | 4 | 0 |
Products
The products that kept showing up in Decidim's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Decidim.
- CVE-2026-44282Election question titles allow stored script execution4.8
- CVE-2026-45378Decidim: Verification documents can be downloaded through reusable links7.5
- CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requests6.4
- CVE-2026-45572Decidim: HTML content blocks allow stored script execution4.8
- CVE-2026-45415Decidim: CSV census record endpoints improper authorization6.0
- CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizations8.5
- CVE-2026-45377Decidim: Private exports can be downloaded through reusable links6.5
- CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sorting5.5
- CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisations4.9
- CVE-2026-45086Decidim: Forms admin question editor lacks authorization5.4
- CVE-2026-40869Decidim amendments can be accepted or rejected by anyone7.5
- CVE-2026-40870Decidim's comments API allows access to all commentable resources7.5
- CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name field8.7
- CVE-2025-65017Decidim's private data exports can lead to data leaks6.5
- CVE-2024-45594Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds7.7
The record
- Peak rank
- #173 in Feb 2024
- Busiest month shown
- Feb 2024, 4 CVEs
- Months with a KEV entry
- 0 since Jul 2023
- Monthly snapshots
- 2 since 2023