Vaadin Flow vulnerabilities

• flarum framework, nextcloud flow, vaadin +2 more Push Endpoint Returns Permissive CORS Headers CVE-2026-110737 2.3 LowOctober 27, 2026
• vaadin @vaadin/charts, vaadin, vaadin vaadin-charts-flow +1 more +3 more Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts CVE-2026-107588 8.4 HighOctober 21, 2026
• vaadin, vaadin vaadin-spreadsheet, vaadin-spreadsheet-flow +2 more Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells CVE-2026-93547 5.3 MediumSeptember 30, 2026
• vaadin @vaadin/charts, @vaadin/component-base, vaadin +2 more +4 more Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge CVE-2026-91860 6.3 MediumSeptember 30, 2026
• nextcloud flow Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build CVE-2026-7860 Fix available 1.6 LowMay 19, 2026
• vaadin, nextcloud flow +1 more Unauthorized session creation via reserved framework path access CVE-2026-2742 Fix available 5.3 MediumMarch 10, 2026
• vaadin, nextcloud flow +1 more Zip Slip Path Traversal on Node Unpack CVE-2026-2741 Fix available 2.3 LowMarch 10, 2026
• flarum framework, vaadin, vaadin vaadin-spreadsheet-flow +2 more Cross-site scripting in Action caption CVE-2025-15022 Fix available 4.8 MediumJanuary 5, 2026
• vaadin, vaadin vaadin-upload-flow, flarum framework +2 more Possibility to bypass file upload validation on the server-side CVE-2025-9467 Fix available 5.3 MediumSeptember 4, 2025
• vaadin, flow flow-server +1 more Possible information disclosure in non visible components CVE-2023-25499 Fix available 5.7 MediumJune 22, 2023
• vaadin, vaadin vaadin-grid-flow +1 more Possible information disclosure inside TreeGrid component with default data provider CVE-2022-29567 Fix available 5.7 MediumMay 24, 2022
• vaadin, vaadin vaadin-checkbox-flow +1 more Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20 CVE-2021-33605 Fix available 4.3 MediumAugust 25, 2021
• flow flow-server, vaadin flow, vaadin +2 more Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 CVE-2021-31412 Fix available 5.3 MediumJune 24, 2021
• flow flow-server, vaadin +1 more Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 CVE-2021-33604 Fix available 2.5 LowJune 24, 2021
• flow flow-server, vaadin flow, vaadin +2 more Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVE-2021-31411 Fix available 6.3 MediumMay 5, 2021
• vaadin flow, flow-client, vaadin +2 more Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVE-2021-31408 Fix available 6.3 MediumApril 22, 2021
• flow flow-server, vaadin flow, vaadin +2 more Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 CVE-2018-25007 Fix available 2.6 LowApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 CVE-2019-25027 Fix available 6.1 MediumApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Potential sensitive data exposure in applications using Vaadin 15 CVE-2020-36319 Fix available 3.1 LowApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Directory traversal in development mode handler in Vaadin 14 and 15-17 CVE-2020-36321 Fix available 5.9 MediumApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 CVE-2021-31404 Fix available 4.0 MediumApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVE-2021-31407 Fix available 8.6 HighApril 19, 2021
• flow flow-server, vaadin flow, vaadin +2 more Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 CVE-2021-31406 Fix available 4.0 MediumApril 19, 2021
• vaadin flow, vaadin, vaadin vaadin-text-field-flow +2 more Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVE-2021-31405 Fix available 7.5 HighApril 19, 2021