CVE-2026-7860
Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4
Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.
ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4
Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.
ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5
- Record
CVE-2026-7860- CVSS 4.0
- 1.6 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2026-30891
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4
Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.
ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5
- Record
EUVD-2026-30891- CVSS 4.0
- 1.6 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j8mx-j73w-9mxw
Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
| Product version | Mitigation |
|---|---|
| Vaadin 23.0.0 - 23.6.10 | Upgrade to 23.6.11 |
| Vaadin 24.0.0 - 24.9.17 | Upgrade to 24.9.18 |
| Vaadin 24.10.0 - 24.10.3 | Upgrade to 24.10.4 |
| Vaadin 25.0.0 - 25.0.11 | Upgrade to 25.0.12 |
| Vaadin 25.1.0 - 25.1.4 | Upgrade to 25.1.5 or newer |
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.
| Maven coordinates | Vulnerable version | Fixed version |
|---|---|---|
| com.vaadin:flow-plugin-base | 23.0.0 - 23.6.10 | ≥ 23.6.11 |
| com.vaadin:flow-plugin-base | 24.0.0 - 24.9.17 | ≥ 24.9.18 |
| com.vaadin:flow-plugin-base | 24.0.0 - 24.10.3 | ≥ 24.10.4 |
| com.vaadin:flow-plugin-base | 25.0.0 - 25.0.11 | ≥ 25.0.12 |
| com.vaadin:flow-plugin-base | 25.1.0 - 25.1.4 | ≥ 25.1.5 |
| com.vaadin:flow-maven-plugin | 23.0.0 - 23.6.10 | ≥ 23.6.11 |
| com.vaadin:flow-maven-plugin | 24.0.0 - 24.9.17 | ≥ 24.9.18 |
| com.vaadin:flow-maven-plugin | 24.0.0 - 24.10.3 | ≥ 24.10.4 |
| com.vaadin:flow-maven-plugin | 25.0.0 - 25.0.11 | ≥ 25.0.12 |
| com.vaadin:flow-maven-plugin | 25.1.0 - 25.1.4 | ≥ 25.1.5 |
| com.vaadin:flow-gradle-plugin | 24.0.0 - 24.9.17 | ≥ 24.9.18 |
| com.vaadin:flow-gradle-plugin | 24.0.0 - 24.10.3 | ≥ 24.10.4 |
| com.vaadin:flow-gradle-plugin | 25.0.0 - 25.0.11 | ≥ 25.0.12 |
| com.vaadin:flow-gradle-plugin | 25.1.0 - 25.1.4 | ≥ 25.1.5 |
- Record
GHSA-j8mx-j73w-9mxw- CVSS 4.0
- 1.6 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4
Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.
ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5
- Record
CVE-2026-7860- CVSS 4.0
- 1.6 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:C/RE:L/U:Green - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4
Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.
ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5
- Record
CVE-2026-7860- CVSS 4.0
- 1.6 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-j8mx-j73w-9mxw
Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
| Product version | Mitigation |
|---|---|
| Vaadin 23.0.0 - 23.6.10 | Upgrade to 23.6.11 |
| Vaadin 24.0.0 - 24.9.17 | Upgrade to 24.9.18 |
| Vaadin 24.10.0 - 24.10.3 | Upgrade to 24.10.4 |
| Vaadin 25.0.0 - 25.0.11 | Upgrade to 25.0.12 |
| Vaadin 25.1.0 - 25.1.4 | Upgrade to 25.1.5 or newer |
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.
| Maven coordinates | Vulnerable version | Fixed version |
|---|---|---|
| com.vaadin:flow-plugin-base | 23.0.0 - 23.6.10 | ≥ 23.6.11 |
| com.vaadin:flow-plugin-base | 24.0.0 - 24.9.17 | ≥ 24.9.18 |
| com.vaadin:flow-plugin-base | 24.0.0 - 24.10.3 | ≥ 24.10.4 |
| com.vaadin:flow-plugin-base | 25.0.0 - 25.0.11 | ≥ 25.0.12 |
| com.vaadin:flow-plugin-base | 25.1.0 - 25.1.4 | ≥ 25.1.5 |
| com.vaadin:flow-maven-plugin | 23.0.0 - 23.6.10 | ≥ 23.6.11 |
| com.vaadin:flow-maven-plugin | 24.0.0 - 24.9.17 | ≥ 24.9.18 |
| com.vaadin:flow-maven-plugin | 24.0.0 - 24.10.3 | ≥ 24.10.4 |
| com.vaadin:flow-maven-plugin | 25.0.0 - 25.0.11 | ≥ 25.0.12 |
| com.vaadin:flow-maven-plugin | 25.1.0 - 25.1.4 | ≥ 25.1.5 |
| com.vaadin:flow-gradle-plugin | 24.0.0 - 24.9.17 | ≥ 24.9.18 |
| com.vaadin:flow-gradle-plugin | 24.0.0 - 24.10.3 | ≥ 24.10.4 |
| com.vaadin:flow-gradle-plugin | 25.0.0 - 25.0.11 | ≥ 25.0.12 |
| com.vaadin:flow-gradle-plugin | 25.1.0 - 25.1.4 | ≥ 25.1.5 |
- Record
GHSA-j8mx-j73w-9mxw- CVSS 4.0
- 1.6 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green - Weakness
- CWE-209
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:flow-pluginsMaven |
23.0.0 up to 23.6.10 | 23.6.10 |
com.vaadin:flow-pluginsMaven |
24.0.0 up to 24.9.17 | 24.9.17 |
com.vaadin:flow-pluginsMaven |
24.10.0 up to 24.10.4 | 24.10.4 |
com.vaadin:flow-pluginsMaven |
25.0.0 up to 25.0.11 | 25.0.11 |
com.vaadin:flow-pluginsMaven |
25.1.0 up to 25.1.5 | 25.1.5 |
com.vaadin:flow-maven-pluginMaven |
23.0.0 up to 23.6.10 | 23.6.10 |
com.vaadin:flow-maven-pluginMaven |
24.0.0 up to 24.9.17 | 24.9.17 |
com.vaadin:flow-maven-pluginMaven |
24.10.0 up to 24.10.4 | 24.10.4 |
com.vaadin:flow-maven-pluginMaven |
25.0.0 up to 25.0.11 | 25.0.11 |
com.vaadin:flow-maven-pluginMaven |
25.1.0 up to 25.1.5 | 25.1.5 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:flow-gradle-pluginMaven |
24.0.0 up to 24.9.17 | 24.9.17 |
com.vaadin:flow-gradle-pluginMaven |
24.10.0 up to 24.10.4 | 24.10.4 |
com.vaadin:flow-gradle-pluginMaven |
25.0.0 up to 25.0.11 | 25.0.11 |
com.vaadin:flow-gradle-pluginMaven |
25.1.0 up to 25.1.5 | 25.1.5 |
com.vaadin:flow-pluginsMaven |
23.0.0 up to 23.6.11, plus listed versions 23.0.123.0.1023.0.1123.0.1223.0.13 Show 45 moreShow less23.0.1423.0.223.0.323.0.423.0.523.0.623.0.723.0.823.0.923.1.023.1.123.1.1023.1.1123.1.1223.1.223.1.323.1.423.1.523.1.623.1.723.1.823.1.923.2.023.2.123.2.1023.2.1123.2.223.2.323.2.423.2.523.2.623.2.723.2.823.2.923.3.023.3.123.3.1023.3.1123.3.1223.3.1323.3.1423.3.1523.3.1623.3.1723.3.18 |
23.6.11 |
com.vaadin:flow-pluginsMaven |
24.0.0 up to 24.9.18, plus listed versions 24.0.124.0.1024.0.1124.0.1224.0.13 Show 45 moreShow less24.0.1424.0.1524.0.1624.0.1724.0.224.0.324.0.424.0.524.0.624.0.724.0.824.0.924.1.024.1.124.1.1024.1.1124.1.1224.1.1324.1.1424.1.1524.1.1624.1.1724.1.1824.1.1924.1.224.1.2024.1.2124.1.2224.1.324.1.424.1.524.1.624.1.724.1.824.1.924.2.024.2.124.2.1024.2.1124.2.1224.2.1324.2.224.2.324.2.424.2.5 |
24.9.18 |
com.vaadin:flow-pluginsMaven |
24.10.0 up to 24.10.4, plus listed versions 24.10.124.10.224.10.3 |
24.10.4 |
com.vaadin:flow-pluginsMaven |
25.0.0 up to 25.0.12, plus listed versions 25.0.125.0.1025.0.1125.0.225.0.3 Show 6 moreShow less25.0.425.0.525.0.625.0.725.0.825.0.9 |
25.0.12 |
com.vaadin:flow-pluginsMaven |
25.1.0 up to 25.1.5, plus listed versions 25.1.125.1.225.1.325.1.4 |
25.1.5 |
com.vaadin:flow-maven-pluginMaven |
23.0.0 up to 23.6.11, plus listed versions 23.0.123.0.1023.0.1123.0.1223.0.13 Show 45 moreShow less23.0.1423.0.223.0.323.0.423.0.523.0.623.0.723.0.823.0.923.1.023.1.123.1.1023.1.1123.1.1223.1.223.1.323.1.423.1.523.1.623.1.723.1.823.1.923.2.023.2.123.2.1023.2.1123.2.223.2.323.2.423.2.523.2.623.2.723.2.823.2.923.3.023.3.123.3.1023.3.1123.3.1223.3.1323.3.1423.3.1523.3.1623.3.1723.3.18 |
23.6.11 |
com.vaadin:flow-maven-pluginMaven |
24.0.0 up to 24.9.18, plus listed versions 24.0.124.0.1024.0.1124.0.1224.0.13 Show 45 moreShow less24.0.1424.0.1524.0.1624.0.1724.0.224.0.324.0.424.0.524.0.624.0.724.0.824.0.924.1.024.1.124.1.1024.1.1124.1.1224.1.1324.1.1424.1.1524.1.1624.1.1724.1.1824.1.1924.1.224.1.2024.1.2124.1.2224.1.324.1.424.1.524.1.624.1.724.1.824.1.924.2.024.2.124.2.1024.2.1124.2.1224.2.1324.2.224.2.324.2.424.2.5 |
24.9.18 |
com.vaadin:flow-maven-pluginMaven |
24.10.0 up to 24.10.4, plus listed versions 24.10.124.10.224.10.3 |
24.10.4 |
com.vaadin:flow-maven-pluginMaven |
25.0.0 up to 25.0.12, plus listed versions 25.0.125.0.1025.0.1125.0.225.0.3 Show 6 moreShow less25.0.425.0.525.0.625.0.725.0.825.0.9 |
25.0.12 |
com.vaadin:flow-maven-pluginMaven |
25.1.0 up to 25.1.5, plus listed versions 25.1.125.1.225.1.325.1.4 |
25.1.5 |
com.vaadin:flow-gradle-pluginMaven |
24.0.0 up to 24.9.18, plus listed versions 24.0.124.0.1024.0.1124.0.1224.0.13 Show 45 moreShow less24.0.1424.0.1524.0.1624.0.1724.0.224.0.324.0.424.0.524.0.624.0.724.0.824.0.924.1.024.1.124.1.1024.1.1124.1.1224.1.1324.1.1424.1.1524.1.1624.1.1724.1.1824.1.1924.1.224.1.2024.1.2124.1.2224.1.324.1.424.1.524.1.624.1.724.1.824.1.924.2.024.2.124.2.1024.2.1124.2.1224.2.1324.2.224.2.324.2.424.2.5 |
24.9.18 |
com.vaadin:flow-gradle-pluginMaven |
24.10.0 up to 24.10.4, plus listed versions 24.10.124.10.224.10.3 |
24.10.4 |
com.vaadin:flow-gradle-pluginMaven |
25.0.0 up to 25.0.12, plus listed versions 25.0.125.0.1025.0.1125.0.225.0.3 Show 6 moreShow less25.0.425.0.525.0.625.0.725.0.825.0.9 |
25.0.12 |
com.vaadin:flow-gradle-pluginMaven |
25.1.0 up to 25.1.5, plus listed versions 25.1.125.1.225.1.325.1.4 |
25.1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-7860 is a low vulnerability (CVSS 1.6) in Nextcloud Flow, published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in com.vaadin:flow-plugins 23.6.10.
References
Left out here: 515 versions. The JSON record has them.