FL
Product
flow
13
CVEs
0
On KEV
7.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 4Low 4
Watch
Add flow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-31406 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and… Affected: 3.0.0 before 5.0.4; 6.0.0 |
| CVE-2021-31404 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0… Affected: 1.0.0 before 1.0.14; 1.1.0 before 2.0.0; 2.0.0 before 2.4.7; 3.0.0 before 5.0.0; 5.0.0 before 5.0.3 |
| CVE-2026-110737 New | 2.3 | Oct 27 | Push Endpoint Returns Permissive CORS Headers Affected: 2.13.0 before 2.13.8; 23.6.0 before 23.6.16; 24.4.0 before 24.4.19; 24.5.0 through 24.5.17; 24.6.0 through 24.6.14; 24.7.0 before 24.7.16; +7 more |
| CVE-2026-7860 | 1.6 | May 19 | Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build Affected: 23.0.0 through 23.6.10; 24.0.0 through 24.9.17; 24.10.0 through 24.10.3; 25.0.0 through 25.0.11; 25.1.0 through 25.1.4; 23.0.0 through 23.6.10; +9 more |
Showing 4