Vaadin flow

• CVE-2026-110737 Low 2.3 Push Endpoint Returns Permissive CORS Headers 0.2%
• CVE-2026-7860 Low 1.6 Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build 0.1%
• CVE-2026-2742 Medium 5.3 Unauthorized session creation via reserved framework path access 0.4%
• CVE-2026-2741 Low 2.3 Zip Slip Path Traversal on Node Unpack 0.4%