https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:05:33.602509+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-291280 EUVD-2026-291280 2026-10-07T03:05:33.651930+00:00 EUVD-2026-291280 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23891 fkie_cve-2026-23891 2026-10-07T03:05:33.651969+00:00

Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.

 https://cve.radiocsirt.org/vuln/ghsa-fc46-r95f-hq7g GHSA-fc46-r95f-hq7g — Decidim has a cross-site scripting (XSS) in user name 2026-10-07T03:05:33.652005+00:00

Affected: RubyGems: decidim-core

### Impact A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.

### Patches N/A

### Workarounds Not available

### References OWASP ASVS v4.0.3-5.1.3

### Credits This issue was discovered in a security audit organized by [octree](https://octree.ch/) and made by [Secu Labs](https://seculabs.ch/) against Decidim financed by the city of Lausanne (Switzerland).