D
Vendor security profile
decidim
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit6
Patch rate%11
Avg. CVSS6.0
12-month vulnerability rate
0
0
0
0
0
0
0
0
3
5
1
0
CVE KEV
CVE severity distribution
9toplam CVE
High2 (22%)
Medium7 (78%)
Patch and exploitation view
%11
Verified patch
%0
CISA KEV
%67
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
8Unknown
Latest vulnerabilities
4.8
CVE-2026-44282
Election question titles allow stored script execution
D
Patch verifiedEPSS %0
7.5
CVE-2026-45378
Decidim: Verification documents can be downloaded through reusable links
D
Patch status unknownEPSS %0
6.4
CVE-2026-45573
Decidim: Push subscriptions can be abused for server-side requests
D
Patch status unknownEPSS %0
4.8
CVE-2026-45572
Decidim: HTML content blocks allow stored script execution
D
Patch status unknownEPSS %0
6.0
CVE-2026-45415
Decidim: CSV census record endpoints improper authorization
D
Patch status unknownEPSS %0
8.5
CVE-2026-45414
Decidim: JWT-backed authentication can be replayed across organizations
D
Patch status unknownEPSS %0
5.5
CVE-2026-45376
Decidim: Admin user search allows SQL injection through similarity-based sorting
D
Patch status unknownEPSS %1
4.9
CVE-2026-45330
Decidim: Verification admins can access supplied IDs from other organisations
D
Patch status unknownEPSS %0
5.4
CVE-2026-45086
Decidim: Forms admin question editor lacks authorization
D
Patch status unknownEPSS %0