decidim-core vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-45573Mediumdecidim-core: Decidim: Push subscriptions can be abused for server-side requests CVE-2026-45572Mediumdecidim-core: Decidim: HTML content blocks allow stored script execution CVE-2026-45377Mediumdecidim-core: Decidim: Private exports can be downloaded through reusable links CVE-2026-40869Highdecidim-core: Decidim amendments can be accepted or rejected by anyone CVE-2026-23891Criticaldecidim-core: Decidim has a cross-site scripting (XSS) in user name CVE-2025-65017Highdecidim-core: Decidim's private data exports can lead to data leaks CVE-2023-51447Mediumdecidim: Cross-site scripting (XSS) in the dynamic file uploads CVE-2023-32693Mediumdecidim-core: Decidim Cross-site Scripting vulnerability in the external link redirections CVE-2023-34089Highdecidim: Decidim Cross-site Scripting vulnerability in the processes filter

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo