Skip to content

Vaadin vulnerabilities

Products

Newest

flarum framework, nextcloud flow, vaadin +2 more Push Endpoint Returns Permissive CORS Headers CVE-2026-110737 2.3 LowOctober 27, 2026
vaadin android-json Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json CVE-2026-110974 6.3 MediumOctober 22, 2026
flarum framework Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8 CVE-2026-110803 8.7 HighOctober 21, 2026
vaadin @vaadin/charts, vaadin, vaadin vaadin-charts-flow +1 more +3 more Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts CVE-2026-107588 8.4 HighOctober 21, 2026
vaadin, vaadin vaadin-spreadsheet, vaadin-spreadsheet-flow +2 more Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells CVE-2026-93547 5.3 MediumSeptember 30, 2026
vaadin @vaadin/charts, @vaadin/component-base, vaadin +2 more +4 more Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge CVE-2026-91860 6.3 MediumSeptember 30, 2026
nextcloud flow Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build CVE-2026-7860 Fix available 1.6 LowMay 19, 2026
vaadin, nextcloud flow +1 more Unauthorized session creation via reserved framework path access CVE-2026-2742 Fix available 5.3 MediumMarch 10, 2026
vaadin, nextcloud flow +1 more Zip Slip Path Traversal on Node Unpack CVE-2026-2741 Fix available 2.3 LowMarch 10, 2026
flarum framework, vaadin, vaadin vaadin-spreadsheet-flow +2 more Cross-site scripting in Action caption CVE-2025-15022 Fix available 4.8 MediumJanuary 5, 2026
vaadin, vaadin vaadin-upload-flow, flarum framework +2 more Possibility to bypass file upload validation on the server-side CVE-2025-9467 Fix available 5.3 MediumSeptember 4, 2025
vaadin, flow flow-server +1 more Vaadin vulnerable to possible information disclosure of class and method names in RPC response CVE-2023-25500 Fix available 3.5 LowJune 22, 2023
vaadin, flow flow-server +1 more Possible information disclosure in non visible components CVE-2023-25499 Fix available 5.7 MediumJune 22, 2023
vaadin, vaadin vaadin-grid-flow +1 more Possible information disclosure inside TreeGrid component with default data provider CVE-2022-29567 Fix available 5.7 MediumMay 24, 2022
vaadin, vaadin vaadin-menu-bar +1 more Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14 CVE-2021-33611 Fix available 6.1 MediumNovember 2, 2021
vaadin, vaadin vaadin-server +1 more Denial of service in DataCommunicator class in Vaadin 8 CVE-2021-33609 Fix available 4.3 MediumOctober 13, 2021
vaadin, vaadin vaadin-checkbox-flow +1 more Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20 CVE-2021-33605 Fix available 4.3 MediumAugust 25, 2021
flow flow-server, vaadin flow, vaadin +2 more Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 CVE-2021-31412 Fix available 5.3 MediumJune 24, 2021
flow flow-server, vaadin +1 more Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 CVE-2021-33604 Fix available 2.5 LowJune 24, 2021
flow flow-server, vaadin flow, vaadin +2 more Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVE-2021-31411 Fix available 6.3 MediumMay 5, 2021
vaadin, vaadin vaadin-compatibility-server +1 more Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVE-2021-31409 Fix available 7.5 HighMay 4, 2021
codegearthemes designer Project sources exposure in Vaadin Designer CVE-2021-31410 8.6 HighApril 23, 2021
vaadin flow, flow-client, vaadin +2 more Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVE-2021-31408 Fix available 6.3 MediumApril 22, 2021
flow flow-server, vaadin flow, vaadin +2 more Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 CVE-2018-25007 Fix available 2.6 LowApril 19, 2021
flow flow-server, vaadin flow, vaadin +2 more Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 CVE-2019-25027 Fix available 6.1 MediumApril 19, 2021
flow flow-server, vaadin flow, vaadin +2 more Potential sensitive data exposure in applications using Vaadin 15 CVE-2020-36319 Fix available 3.1 LowApril 19, 2021
flow flow-server, vaadin flow, vaadin +2 more Directory traversal in development mode handler in Vaadin 14 and 15-17 CVE-2020-36321 Fix available 5.9 MediumApril 19, 2021
flow flow-server, vaadin flow, vaadin +2 more Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 CVE-2021-31404 Fix available 4.0 MediumApril 19, 2021
vaadin, vaadin vaadin-server +1 more Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8 CVE-2021-31403 Fix available 4.0 MediumApril 19, 2021
flow flow-server, vaadin flow, vaadin +2 more Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVE-2021-31407 Fix available 8.6 HighApril 19, 2021
flow flow-server, vaadin flow, vaadin +2 more Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 CVE-2021-31406 Fix available 4.0 MediumApril 19, 2021
vaadin, vaadin vaadin-server +1 more Stored cross-site scripting in Grid component in Vaadin 7 and 8 CVE-2019-25028 Fix available 5.4 MediumApril 19, 2021
vaadin, vaadin vaadin-server +1 more Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVE-2020-36320 Fix available 7.5 HighApril 19, 2021
vaadin flow, vaadin, vaadin vaadin-text-field-flow +2 more Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVE-2021-31405 Fix available 7.5 HighApril 19, 2021
vaadin Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject... CVE-2011-0509 4.3 MediumJanuary 20, 2011