Vaadin
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Vaadin | 27 | – | Oct 27, 2026 |
| flow-server | 9 | – | Jun 22, 2023 |
| flow | 4 | – | Oct 27, 2026 |
| framework | 4 | – | Oct 27, 2026 |
| vaadin-server | 3 | – | Oct 13, 2021 |
| vaadin-charts-flow | 2 | – | Oct 21, 2026 |
| @vaadin/charts | 2 | – | Oct 21, 2026 |
| vaadin-spreadsheet-flow | 2 | – | Sep 30, 2026 |
| vaadin-menu-bar | 1 | – | Nov 2, 2021 |
| vaadin-spreadsheet | 1 | – | Sep 30, 2026 |
| vaadin-text-field-flow | 1 | – | Apr 23, 2021 |
| vaadin-upload-flow | 1 | – | Sep 4, 2025 |
| android-json | 1 | – | Oct 22, 2026 |
| @vaadin/component-base | 1 | – | Sep 30, 2026 |
| Designer | 1 | – | Apr 23, 2021 |
| flow-client | 1 | – | Apr 23, 2021 |
| vaadin-charts-flow-svg-generator | 1 | – | Oct 21, 2026 |
| vaadin-checkbox-flow | 1 | – | Aug 25, 2021 |
| vaadin-compatibility-server | 1 | – | May 5, 2021 |
| vaadin-core | 1 | – | Sep 30, 2026 |
| vaadin-grid-flow | 1 | – | May 24, 2022 |
Exploited and recent CVEs
- CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers 0.2%
- CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers 0.2%
- CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers 0.2%
- CVE-2026-110974 Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json 0.3%
- CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8 0.3%
- CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts 0.5%
- CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts 0.5%
- CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts 0.5%
- CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts 0.5%
- CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells 0.4%
- CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells 0.4%
- CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells 0.4%
- CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge 0.5%
- CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge 0.5%
- CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge 0.5%
- CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge 0.5%
- CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge 0.5%
- CVE-2026-7860 Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build 0.1%
- CVE-2026-2742 Unauthorized session creation via reserved framework path access 0.4%
- CVE-2026-2742 Unauthorized session creation via reserved framework path access 0.4%
- CVE-2026-2741 Zip Slip Path Traversal on Node Unpack 0.4%
- CVE-2026-2741 Zip Slip Path Traversal on Node Unpack 0.4%
- CVE-2025-15022 Cross-site scripting in Action caption 0.3%
- CVE-2025-15022 Cross-site scripting in Action caption 0.3%
- CVE-2025-15022 Cross-site scripting in Action caption 0.3%
- CVE-2025-9467 Possibility to bypass file upload validation on the server-side 0.4%
- CVE-2025-9467 Possibility to bypass file upload validation on the server-side 0.4%
- CVE-2025-9467 Possibility to bypass file upload validation on the server-side 0.4%
- CVE-2023-25500 Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information 0.5%
- CVE-2023-25499 Possible information disclosure in non visible components 0.6%