Vaadin

Latest CVEs · RSS

• CVE-2026-93547 2026-09-30 · CVSS 5.3
  A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace ce
• CVE-2026-91860 2026-09-30 · CVSS 6.3
  A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not cont
• CVE-2026-7860 2026-05-19 · CVSS 1.6
  A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in
• CVE-2026-2742 2026-03-10 · CVSS 5.3
  An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applicat
• CVE-2026-2741 2026-03-10 · CVSS 2.3
  Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 thro
• CVE-2025-15022 2026-01-05 · CVSS 4.8
  Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user
• CVE-2025-9467 2025-09-04 · CVSS 5.3
  When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affec
• CVE-2023-25500 2023-06-22 · CVSS 3.5
  Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.
• CVE-2023-25499 2023-06-22 · CVSS 5.7
  When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 thr
• CVE-2022-29567 2022-05-24 · CVSS 5.7
  The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22
• CVE-2021-33611 2021-11-02 · CVSS 6.1
  Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows
• CVE-2021-33609 2021-10-13 · CVSS 4.3
  Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network att
• CVE-2021-33605 2021-08-25 · CVSS 4.3
  Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 1
• CVE-2021-31412 2021-06-24 · CVSS 5.3
  Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0
• CVE-2021-33604 2021-06-24 · CVSS 2.5
  URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadi
• CVE-2021-31409 2021-05-05 · CVSS 7.5
  Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.
• CVE-2021-31411 2021-05-05 · CVSS 6.3
  Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2),
• CVE-2021-31410 2021-04-23 · CVSS 8.6
  Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via
• CVE-2021-31408 2021-04-23 · CVSS 6.3
  Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses
• CVE-2021-31407 2021-04-23 · CVSS 8.6
  Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0)
• CVE-2021-31406 2021-04-23 · CVSS 4.0
  Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), a
• CVE-2021-31405 2021-04-23 · CVSS 7.5
  Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 thro
• CVE-2021-31404 2021-04-23 · CVSS 4.0
  Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1
• CVE-2021-31403 2021-04-23 · CVSS 4.0
  Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and
• CVE-2020-36321 2021-04-23 · CVSS 5.9
  Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0