{"schema_version":1,"title":"decidim-core (RubyGems) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in decidim-core (RubyGems): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-45573, was published on 6 August 2026.","url":"https://junglewise.ai/threats/technologies/decidim-core","json_url":"https://junglewise.ai/threats/technologies/decidim-core.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/decidim-core","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":2,"all_time":9,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":6},"latest":[{"cve":"CVE-2026-45573","cvss":6.4,"epss":0.0026,"slug":"cve-2026-45573-decidim-decidim-core-ssrf-in-push-notification-subscriptions","title":"Decidim decidim-core SSRF in push notification subscriptions","severity":"medium","exploited":false,"published_at":"2026-08-06T22:17:07.55+00:00","url":"https://junglewise.ai/threats/cve-2026-45573-decidim-decidim-core-ssrf-in-push-notification-subscriptions"},{"cve":"CVE-2026-45572","cvss":4.8,"epss":0.0025,"slug":"cve-2026-45572-decidim-stored-xss-in-html-content-blocks","title":"Decidim stored XSS in HTML content blocks","severity":"medium","exploited":false,"published_at":"2026-08-06T22:17:07.403+00:00","url":"https://junglewise.ai/threats/cve-2026-45572-decidim-stored-xss-in-html-content-blocks"},{"cve":"CVE-2026-45377","cvss":6.5,"epss":0.0045,"slug":"cve-2026-45377-decidim-improper-access-control-in-private-data-exports","title":"Decidim improper access control in Private Data Exports","severity":"medium","exploited":false,"published_at":"2026-07-31T23:17:24.52+00:00","url":"https://junglewise.ai/threats/cve-2026-45377-decidim-improper-access-control-in-private-data-exports"},{"cve":"CVE-2026-40869","cvss":7.5,"epss":0.0022,"slug":"cve-2026-40869-decidim-decidim-core-incorrect-privilege-assignment-in-amendments","title":"Decidim decidim-core incorrect privilege assignment in amendments","severity":"high","exploited":false,"published_at":"2026-04-21T20:17:00.207+00:00","url":"https://junglewise.ai/threats/cve-2026-40869-decidim-decidim-core-incorrect-privilege-assignment-in-amendments"},{"cve":"CVE-2026-23891","cvss":8.7,"epss":0.0036,"slug":"cve-2026-23891-decidim-stored-xss-in-user-name-field","title":"Decidim stored XSS in user name field","severity":"high","exploited":false,"published_at":"2026-04-13T17:16:28.063+00:00","url":"https://junglewise.ai/threats/cve-2026-23891-decidim-stored-xss-in-user-name-field"},{"cve":"CVE-2025-65017","cvss":4,"epss":0.0028,"slug":"cve-2025-65017-decidim-s-private-data-exports-can-lead-to-data-leaks","title":"Decidim's private data exports can lead to data leaks","severity":"medium","exploited":false,"published_at":"2026-02-03T17:21:17+00:00","url":"https://junglewise.ai/threats/cve-2025-65017-decidim-s-private-data-exports-can-lead-to-data-leaks"},{"cve":"CVE-2023-51447","cvss":3.1,"epss":0.0049,"slug":"cve-2023-51447-cross-site-scripting-xss-in-the-dynamic-file-uploads","title":"Cross-site scripting (XSS) in the dynamic file uploads","severity":"low","exploited":false,"published_at":"2024-02-20T23:42:47+00:00","url":"https://junglewise.ai/threats/cve-2023-51447-cross-site-scripting-xss-in-the-dynamic-file-uploads"},{"cve":"CVE-2023-32693","cvss":3.1,"epss":0.0082,"slug":"cve-2023-32693-decidim-cross-site-scripting-vulnerability-in-the-external-link","title":"Decidim Cross-site Scripting vulnerability in the external link redirections","severity":"low","exploited":false,"published_at":"2023-07-11T22:47:01+00:00","url":"https://junglewise.ai/threats/cve-2023-32693-decidim-cross-site-scripting-vulnerability-in-the-external-link"},{"cve":"CVE-2023-34089","cvss":3.1,"epss":0.0074,"slug":"cve-2023-34089-decidim-cross-site-scripting-vulnerability-in-the-processes","title":"Decidim Cross-site Scripting vulnerability in the processes filter","severity":"low","exploited":false,"published_at":"2023-07-11T22:46:57+00:00","url":"https://junglewise.ai/threats/cve-2023-34089-decidim-cross-site-scripting-vulnerability-in-the-processes"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"actionpack (RubyGems)","slug":"actionpack","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/actionpack"},{"name":"nokogiri (RubyGems)","slug":"nokogiri","vulnerabilities":69,"url":"https://junglewise.ai/threats/technologies/nokogiri"},{"name":"rack (RubyGems)","slug":"rack","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/rack"},{"name":"activerecord (RubyGems)","slug":"rubygems-activerecord","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/rubygems-activerecord"},{"name":"rubygems-update (RubyGems)","slug":"rubygems-update","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/rubygems-update"},{"name":"puppet (RubyGems)","slug":"puppet","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/puppet"},{"name":"activesupport (RubyGems)","slug":"activesupport","vulnerabilities":20,"url":"https://junglewise.ai/threats/technologies/activesupport"},{"name":"actionview (RubyGems)","slug":"actionview","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/actionview"},{"name":"activestorage (RubyGems)","slug":"activestorage","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/activestorage"},{"name":"camaleon_cms (RubyGems)","slug":"camaleon-cms","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/camaleon-cms"},{"name":"rails-html-sanitizer (RubyGems)","slug":"rails-html-sanitizer","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/rails-html-sanitizer"},{"name":"loofah (RubyGems)","slug":"loofah","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/loofah"}],"technology":{"hub":true,"name":"decidim-core (RubyGems)","slug":"decidim-core","vendor":{"hub":true,"name":"RubyGems","slug":"rubygems","url":"https://junglewise.ai/threats/vendors/rubygems"},"aliases":[],"homepage":"https://decidim.org/","repo_url":"https://github.com/decidim/decidim","description":"Ruby gem providing core functionality for Decidim participatory governance platform.","url":"https://junglewise.ai/threats/technologies/decidim-core"},"most_severe":[{"cve":"CVE-2026-23891","cvss":8.7,"epss":0.0036,"slug":"cve-2026-23891-decidim-stored-xss-in-user-name-field","title":"Decidim stored XSS in user name field","severity":"high","exploited":false,"published_at":"2026-04-13T17:16:28.063+00:00","url":"https://junglewise.ai/threats/cve-2026-23891-decidim-stored-xss-in-user-name-field"},{"cve":"CVE-2026-40869","cvss":7.5,"epss":0.0022,"slug":"cve-2026-40869-decidim-decidim-core-incorrect-privilege-assignment-in-amendments","title":"Decidim decidim-core incorrect privilege assignment in amendments","severity":"high","exploited":false,"published_at":"2026-04-21T20:17:00.207+00:00","url":"https://junglewise.ai/threats/cve-2026-40869-decidim-decidim-core-incorrect-privilege-assignment-in-amendments"},{"cve":"CVE-2026-45377","cvss":6.5,"epss":0.0045,"slug":"cve-2026-45377-decidim-improper-access-control-in-private-data-exports","title":"Decidim improper access control in Private Data Exports","severity":"medium","exploited":false,"published_at":"2026-07-31T23:17:24.52+00:00","url":"https://junglewise.ai/threats/cve-2026-45377-decidim-improper-access-control-in-private-data-exports"},{"cve":"CVE-2026-45573","cvss":6.4,"epss":0.0026,"slug":"cve-2026-45573-decidim-decidim-core-ssrf-in-push-notification-subscriptions","title":"Decidim decidim-core SSRF in push notification subscriptions","severity":"medium","exploited":false,"published_at":"2026-08-06T22:17:07.55+00:00","url":"https://junglewise.ai/threats/cve-2026-45573-decidim-decidim-core-ssrf-in-push-notification-subscriptions"},{"cve":"CVE-2026-45572","cvss":4.8,"epss":0.0025,"slug":"cve-2026-45572-decidim-stored-xss-in-html-content-blocks","title":"Decidim stored XSS in HTML content blocks","severity":"medium","exploited":false,"published_at":"2026-08-06T22:17:07.403+00:00","url":"https://junglewise.ai/threats/cve-2026-45572-decidim-stored-xss-in-html-content-blocks"},{"cve":"CVE-2025-65017","cvss":4,"epss":0.0028,"slug":"cve-2025-65017-decidim-s-private-data-exports-can-lead-to-data-leaks","title":"Decidim's private data exports can lead to data leaks","severity":"medium","exploited":false,"published_at":"2026-02-03T17:21:17+00:00","url":"https://junglewise.ai/threats/cve-2025-65017-decidim-s-private-data-exports-can-lead-to-data-leaks"},{"cve":"CVE-2023-32693","cvss":3.1,"epss":0.0082,"slug":"cve-2023-32693-decidim-cross-site-scripting-vulnerability-in-the-external-link","title":"Decidim Cross-site Scripting vulnerability in the external link redirections","severity":"low","exploited":false,"published_at":"2023-07-11T22:47:01+00:00","url":"https://junglewise.ai/threats/cve-2023-32693-decidim-cross-site-scripting-vulnerability-in-the-external-link"},{"cve":"CVE-2023-34089","cvss":3.1,"epss":0.0074,"slug":"cve-2023-34089-decidim-cross-site-scripting-vulnerability-in-the-processes","title":"Decidim Cross-site Scripting vulnerability in the processes filter","severity":"low","exploited":false,"published_at":"2023-07-11T22:46:57+00:00","url":"https://junglewise.ai/threats/cve-2023-34089-decidim-cross-site-scripting-vulnerability-in-the-processes"},{"cve":"CVE-2023-51447","cvss":3.1,"epss":0.0049,"slug":"cve-2023-51447-cross-site-scripting-xss-in-the-dynamic-file-uploads","title":"Cross-site scripting (XSS) in the dynamic file uploads","severity":"low","exploited":false,"published_at":"2024-02-20T23:42:47+00:00","url":"https://junglewise.ai/threats/cve-2023-51447-cross-site-scripting-xss-in-the-dynamic-file-uploads"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}