Vaadin Vaadin

• CVE-2026-110737 Low 2.3 Push Endpoint Returns Permissive CORS Headers 0.2%
• CVE-2026-107588 High 8.4 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts 0.5%
• CVE-2026-93547 Medium 5.3 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells 0.4%
• CVE-2026-91860 Medium 6.3 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge 0.5%
• CVE-2026-2742 Medium 5.3 Unauthorized session creation via reserved framework path access 0.4%
• CVE-2026-2741 Low 2.3 Zip Slip Path Traversal on Node Unpack 0.4%
• CVE-2025-15022 Medium 4.8 Cross-site scripting in Action caption 0.3%
• CVE-2025-9467 Medium 5.3 Possibility to bypass file upload validation on the server-side 0.4%
• CVE-2023-25500 Low 3.5 Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information 0.5%
• CVE-2023-25499 Medium 5.7 Possible information disclosure in non visible components 0.6%
• CVE-2022-29567 Medium 5.7 Possible information disclosure inside TreeGrid component with default data provider 1.0%
• CVE-2021-33611 Medium 6.1 Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14 1.0%
• CVE-2021-33609 Medium 4.3 Denial of service in DataCommunicator class in Vaadin 8 0.9%
• CVE-2021-33605 Medium 4.3 Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20 0.7%
• CVE-2021-31412 Medium 5.3 Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 1.3%
• CVE-2021-33604 Low 2.5 Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 0.3%
• CVE-2021-31409 High 7.5 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 1.7%
• CVE-2021-31411 Medium 6.3 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 0.2%
• CVE-2021-31408 Medium 6.3 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 0.3%
• CVE-2021-31407 High 8.6 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 2.4%
• CVE-2021-31406 Medium 4.0 Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 0.2%
• CVE-2021-31405 High 7.5 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 1.1%
• CVE-2021-31404 Medium 4.0 Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 0.2%
• CVE-2021-31403 Medium 4.0 Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8 0.3%
• CVE-2020-36321 Medium 5.9 Directory traversal in development mode handler in Vaadin 14 and 15-17 1.2%
• CVE-2020-36320 High 7.5 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 2.0%
• CVE-2020-36319 Low 3.1 Potential sensitive data exposure in applications using Vaadin 15 1.0%