Vaadin framework

• CVE-2026-110737 Low 2.3 Push Endpoint Returns Permissive CORS Headers 0.2%
• CVE-2026-110803 High 8.7 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8 0.3%
• CVE-2025-15022 Medium 4.8 Cross-site scripting in Action caption 0.3%
• CVE-2025-9467 Medium 5.3 Possibility to bypass file upload validation on the server-side 0.4%