Vaadin Framework vulnerabilities

• flarum framework, nextcloud flow, vaadin +2 more Push Endpoint Returns Permissive CORS Headers CVE-2026-110737 2.3 LowOctober 27, 2026
• flarum framework Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8 CVE-2026-110803 8.7 HighOctober 21, 2026
• flarum framework, vaadin, vaadin vaadin-spreadsheet-flow +2 more Cross-site scripting in Action caption CVE-2025-15022 Fix available 4.8 MediumJanuary 5, 2026
• vaadin, vaadin vaadin-upload-flow, flarum framework +2 more Possibility to bypass file upload validation on the server-side CVE-2025-9467 Fix available 5.3 MediumSeptember 4, 2025