FL
Product
flow
13
CVEs
0
On KEV
7.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 4Low 4
Watch
Add flow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-31411 | 7.8 | May 5 | Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0… Affected: 2.0.9 before 2.5.3; 3.0.0 through 5.0.0; 6.0.0 through 6.0.6 |
| CVE-2021-31407 | 7.5 | Apr 23 | Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to… Affected: 1.2.0 before 2.4.8; 6.0.0 before 6.0.2 |
| CVE-2021-31405 | 7.5 | Apr 23 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin… Affected: 2.0.4 before 2.3.3; 3.0.0 before 4.0.3 |
| CVE-2020-36321 | 7.5 | Apr 23 | Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to… Affected: 2.0.0 before 2.4.2; 3.0.0 before 5.0.0 |
| CVE-2021-31408 | 7.1 | Apr 23 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP… Affected: 5.0.0 before 6.0.0; 6.0.0 before 6.0.5 |
| CVE-2020-36319 | 6.5 | Apr 23 | Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application… Affected: 3.0.0 before 3.0.6 |
| CVE-2019-25027 | 6.1 | Apr 23 | Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2… Affected: 1.0.0 before 1.0.11; 1.1.0 before 1.4.3 |
| CVE-2021-31412 | 5.3 | Jun 24 | Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0… Affected: 1.0.0 through 1.0.14; 1.1.0 through 1.4.0; 2.0.0 through 2.6.1; 3.0.0 through 5.0.0; 6.0.0 through 6.0.9 |
| CVE-2018-25007 | 4.3 | Apr 23 | Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update… Affected: 1.0.0 before 1.0.6 |
| CVE-2021-31406 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and… Affected: 3.0.0 before 5.0.4; 6.0.0 |
| CVE-2021-31404 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0… Affected: 1.0.0 before 1.0.14; 1.1.0 before 2.0.0; 2.0.0 before 2.4.7; 3.0.0 before 5.0.0; 5.0.0 before 5.0.3 |
| CVE-2026-110737 New | 2.3 | Oct 27 | Push Endpoint Returns Permissive CORS Headers Affected: 2.13.0 before 2.13.8; 23.6.0 before 23.6.16; 24.4.0 before 24.4.19; 24.5.0 through 24.5.17; 24.6.0 through 24.6.14; 24.7.0 before 24.7.16; +7 more |
| CVE-2026-7860 | 1.6 | May 19 | Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build Affected: 23.0.0 through 23.6.10; 24.0.0 through 24.9.17; 24.10.0 through 24.10.3; 25.0.0 through 25.0.11; 25.1.0 through 25.1.4; 23.0.0 through 23.6.10; +9 more |
Showing 13