Flow vulnerabilities

Products

• Flow-server 12

Newest

• flow payment Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter CVE-2026-57857 5.1 MediumJuly 18, 2026
• vaadin, flow flow-server +1 more Vaadin vulnerable to possible information disclosure of class and method names in RPC response CVE-2023-25500 Fix available 3.5 LowJune 22, 2023
• vaadin, flow flow-server +1 more Possible information disclosure in non visible components CVE-2023-25499 Fix available 5.7 MediumJune 22, 2023
• flow flow-server, vaadin flow, vaadin +2 more Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 CVE-2021-31412 Fix available 5.3 MediumJune 24, 2021
• flow flow-server, vaadin +1 more Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 CVE-2021-33604 Fix available 2.5 LowJune 24, 2021
• flow flow-server, vaadin flow, vaadin +2 more Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVE-2021-31411 Fix available 6.3 MediumMay 5, 2021
• flow flow-server, vaadin flow, vaadin +2 more Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 CVE-2018-25007 Fix available 2.6 LowApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 CVE-2019-25027 Fix available 6.1 MediumApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Potential sensitive data exposure in applications using Vaadin 15 CVE-2020-36319 Fix available 3.1 LowApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Directory traversal in development mode handler in Vaadin 14 and 15-17 CVE-2020-36321 Fix available 5.9 MediumApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 CVE-2021-31404 Fix available 4.0 MediumApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVE-2021-31407 Fix available 8.6 HighApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 CVE-2021-31406 Fix available 4.0 MediumApril 19, 2021