Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:gem/decidim-core@0.29.3
Typegem
Namespace
Namedecidim-core
Version0.29.3
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
0
url VCID-4w2m-2bah-d3hr
vulnerability_id VCID-4w2m-2bah-d3hr
summary Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-23891
reference_id
reference_type
scores
0
value 0.00053
scoring_system epss
scoring_elements 0.16819
published_at 2026-06-11T12:55:00Z
1
value 0.00053
scoring_system epss
scoring_elements 0.16963
published_at 2026-06-14T12:55:00Z
2
value 0.00053
scoring_system epss
scoring_elements 0.16988
published_at 2026-06-13T12:55:00Z
3
value 0.00053
scoring_system epss
scoring_elements 0.16976
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-23891
1
reference_url https://github.com/decidim/decidim
reference_id
reference_type
scores
0
value 8.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/decidim/decidim
2
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-23891.yml
reference_id
reference_type
scores
0
value 8.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-23891.yml
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-23891
reference_id
reference_type
scores
0
value 8.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-23891
4
reference_url https://github.com/advisories/GHSA-fc46-r95f-hq7g
reference_id GHSA-fc46-r95f-hq7g
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-fc46-r95f-hq7g
5
reference_url https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g
reference_id GHSA-fc46-r95f-hq7g
reference_type
scores
0
value 8.7
scoring_system cvssv3
scoring_elements
1
value 8.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
2
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
3
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
4
value CRITICAL
scoring_system generic_textual
scoring_elements
5
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:23:47Z/
url https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g
6
reference_url https://github.com/decidim/decidim/releases/tag/v0.30.5
reference_id v0.30.5
reference_type
scores
0
value 8.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:23:47Z/
url https://github.com/decidim/decidim/releases/tag/v0.30.5
7
reference_url https://github.com/decidim/decidim/releases/tag/v0.31.1
reference_id v0.31.1
reference_type
scores
0
value 8.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:23:47Z/
url https://github.com/decidim/decidim/releases/tag/v0.31.1
fixed_packages
0
url pkg:gem/decidim-core@0.30.5
purl pkg:gem/decidim-core@0.30.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4w2m-2bah-d3hr
1
vulnerability VCID-7v8b-huy9-ebe3
2
vulnerability VCID-qsud-c4qy-2ba8
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.30.5
1
url pkg:gem/decidim-core@0.31.1
purl pkg:gem/decidim-core@0.31.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4w2m-2bah-d3hr
1
vulnerability VCID-7v8b-huy9-ebe3
2
vulnerability VCID-qsud-c4qy-2ba8
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.31.1
aliases CVE-2026-23891, GHSA-fc46-r95f-hq7g
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4w2m-2bah-d3hr
1
url VCID-7v8b-huy9-ebe3
vulnerability_id VCID-7v8b-huy9-ebe3
summary Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, disable amendment reactions for the amendable component (e.g. proposals).
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-40869
reference_id
reference_type
scores
0
value 0.0004
scoring_system epss
scoring_elements 0.12445
published_at 2026-06-13T12:55:00Z
1
value 0.0004
scoring_system epss
scoring_elements 0.12425
published_at 2026-06-14T12:55:00Z
2
value 0.0004
scoring_system epss
scoring_elements 0.12347
published_at 2026-06-11T12:55:00Z
3
value 0.0004
scoring_system epss
scoring_elements 0.12437
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-40869
1
reference_url https://github.com/decidim/decidim
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/decidim/decidim
2
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-40869.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-40869.yml
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-40869
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-40869
4
reference_url https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9
reference_id 1b99136a1c7aa02616a0b54a6ab88d12907a57a9
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:35:49Z/
url https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9
5
reference_url https://github.com/advisories/GHSA-w5xj-99cg-rccm
reference_id GHSA-w5xj-99cg-rccm
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w5xj-99cg-rccm
6
reference_url https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm
reference_id GHSA-w5xj-99cg-rccm
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
2
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
3
value HIGH
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:35:49Z/
url https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm
fixed_packages
0
url pkg:gem/decidim-core@0.30.5
purl pkg:gem/decidim-core@0.30.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4w2m-2bah-d3hr
1
vulnerability VCID-7v8b-huy9-ebe3
2
vulnerability VCID-qsud-c4qy-2ba8
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.30.5
1
url pkg:gem/decidim-core@0.31.1
purl pkg:gem/decidim-core@0.31.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4w2m-2bah-d3hr
1
vulnerability VCID-7v8b-huy9-ebe3
2
vulnerability VCID-qsud-c4qy-2ba8
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.31.1
aliases CVE-2026-40869, GHSA-w5xj-99cg-rccm
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7v8b-huy9-ebe3
2
url VCID-qsud-c4qy-2ba8
vulnerability_id VCID-qsud-c4qy-2ba8
summary Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-65017
reference_id
reference_type
scores
0
value 0.00054
scoring_system epss
scoring_elements 0.17467
published_at 2026-06-12T12:55:00Z
1
value 0.00054
scoring_system epss
scoring_elements 0.17455
published_at 2026-06-14T12:55:00Z
2
value 0.00054
scoring_system epss
scoring_elements 0.17304
published_at 2026-06-11T12:55:00Z
3
value 0.00054
scoring_system epss
scoring_elements 0.17483
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-65017
1
reference_url https://github.com/decidim/decidim
reference_id
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/decidim/decidim
2
reference_url https://github.com/decidim/decidim/pull/13571
reference_id 13571
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/
url https://github.com/decidim/decidim/pull/13571
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-65017
reference_id CVE-2025-65017
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-65017
4
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2025-65017.yml
reference_id CVE-2025-65017.YML
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2025-65017.yml
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2025-65017.yml
reference_id CVE-2025-65017.YML
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2025-65017.yml
6
reference_url https://github.com/advisories/GHSA-3cx6-j9j4-54mp
reference_id GHSA-3cx6-j9j4-54mp
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3cx6-j9j4-54mp
7
reference_url https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp
reference_id GHSA-3cx6-j9j4-54mp
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/
url https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp
8
reference_url https://github.com/decidim/decidim/releases/tag/v0.30.4
reference_id v0.30.4
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/
url https://github.com/decidim/decidim/releases/tag/v0.30.4
9
reference_url https://github.com/decidim/decidim/releases/tag/v0.31.0
reference_id v0.31.0
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/
url https://github.com/decidim/decidim/releases/tag/v0.31.0
fixed_packages
0
url pkg:gem/decidim-core@0.30.4
purl pkg:gem/decidim-core@0.30.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4w2m-2bah-d3hr
1
vulnerability VCID-7v8b-huy9-ebe3
2
vulnerability VCID-qsud-c4qy-2ba8
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.30.4
1
url pkg:gem/decidim-core@0.31.0
purl pkg:gem/decidim-core@0.31.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4w2m-2bah-d3hr
1
vulnerability VCID-7v8b-huy9-ebe3
2
vulnerability VCID-qsud-c4qy-2ba8
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.31.0
aliases CVE-2025-65017, GHSA-3cx6-j9j4-54mp
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qsud-c4qy-2ba8
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.29.3