https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 00:34:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291280 EUVD-2026-291280 https://cve.radiocsirt.org/vuln/euvd-2026-291280 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23891 <p>Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.</p> <p>Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23891 https://cve.radiocsirt.org/vuln/ghsa-fc46-r95f-hq7g <p><strong>Affected:</strong> RubyGems: decidim-core</p> <p>### Impact A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.</p> <p>### Patches N/A</p> <p>### Workarounds Not available</p> <p>### References OWASP ASVS v4.0.3-5.1.3</p> <p>### Credits This issue was discovered in a security audit organized by [octree](https://octree.ch/) and made by [Secu Labs](https://seculabs.ch/) against Decidim financed by the city of Lausanne (Switzerland).</p> <p><strong>Affected:</strong> RubyGems: decidim-core</p> <p>### Impact A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.</p> <p>### Patches N/A</p> <p>### Workarounds Not available</p> <p>### References OWASP ASVS v4.0.3-5.1.3</p> <p>### Credits This issue was discovered in a security audit organized by [octree](https://octree.ch/) and made by [Secu Labs](https://seculabs.ch/) against Decidim financed by the city of Lausanne (Switzerland).</p> https://cve.radiocsirt.org/vuln/ghsa-fc46-r95f-hq7g