decidim-core (RubyGems) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the RubyGems package decidim-core, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2026-23891 — CVSS 8.7 (high): Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution…
• CVE-2023-32693 — CVSS 8.1 (high): Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and…
• CVE-2023-34089 — CVSS 8.1 (high): Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and…
• CVE-2026-40869 — CVSS 7.5 (high): Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows…
• CVE-2025-65017 — CVSS 6.5 (medium): Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private…
• CVE-2023-51447 — CVSS 6.3 (medium): Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload…