VA
Product
vaadin
28
CVEs
0
On KEV
8.4
Max CVSS
4
New 30D
Severity mix
Critical 0High 9Medium 13Low 5
Watch
Add vaadin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107588 New | 8.4 | Oct 21 | Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts Affected: 22.0.0 before 23.6.16; 24.0.0 before 24.4.24; 24.5.0 before 24.7.16; 24.8.0 before 24.9.23; 24.10.0 before 24.10.11; 25.0.0 through 25.0.13; +3 more |
| CVE-2021-31411 | 7.8 | May 5 | Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0… Affected: 14.0.3 before 14.5.3; 15.0.0 before 19.0.5 |
| CVE-2022-29567 | 7.5 | May 24 | The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through… Affected: 14.8.5 through 14.8.9; 22.0.6 through 22.0.15; 23.0.1 through 23.0.8; 23.0.0; 23.0.0; 23.0.0; +6 more |
| CVE-2021-31409 | 7.5 | May 6 | Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers… Affected: 8.0.0 through 8.12.4 |
| CVE-2021-31407 | 7.5 | Apr 23 | Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to… Affected: 12.0.0 before 14.4.10; 19.0.0 |
| CVE-2021-31405 | 7.5 | Apr 23 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin… Affected: 14.0.6 before 14.4.4; 15.0.0 before 17.0.11 |
| CVE-2020-36321 | 7.5 | Apr 23 | Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to… Affected: 14.0.0 before 14.4.3; 15.0.0 before 18.0.0 |
| CVE-2020-36320 | 7.5 | Apr 23 | Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled… Affected: 7.0.0 before 7.7.22 |
| CVE-2021-31408 | 7.1 | Apr 23 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP… Affected: 19.0.0 before 19.0.4; 18.0.0 |
| CVE-2026-2741 | 6.8 | Mar 10 | Zip Slip Path Traversal on Node Unpack Affected: 14.2.0 through 14.14.0; 15.0.0 through 23.6.6; 24.0.0 through 24.9.8; 25.0.0 through 25.0.2 |
| CVE-2023-25499 | 6.5 | Jun 22 | When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28,… Affected: 10.0.0 before 10.0.23; 11.0.0 before 14.10.1; 15.0.0 through 22.0.28; 23.0.0 before 23.3.13; 24.0.0 before 24.0.6; 24.1.0; +6 more |
| CVE-2020-36319 | 6.5 | Apr 23 | Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application… Affected: 15.0.0 before 15.0.5 |
| CVE-2026-91860 | 6.3 | Sep 30 | Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge Affected: 23.0.0 before 23.6.14; 24.0.0 before 24.9.21; 24.10.0 before 24.10.10; 25.0.0 before 25.1.12; 25.2.0 before 25.2.7 |
| CVE-2021-33611 | 6.1 | Nov 2 | Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers… Affected: 14.0.0 through 14.4.4 |
| CVE-2019-25028 | 6.1 | Apr 23 | Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0… Affected: 7.4.0 before 7.7.20; 8.0.0 before 8.8.5 |
| CVE-2019-25027 | 6.1 | Apr 23 | Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2… Affected: 10.0.0 before 10.0.14; 11.0.0 before 13.0.6 |
| CVE-2026-93547 | 5.3 | Sep 30 | Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells Affected: 23.1.0 before 23.6.14; 24.0.0 before 24.9.22; 24.10.0 before 24.10.10; 25.0.0 before 25.1.12; 25.2.0 before 25.2.7 |
| CVE-2026-2742 | 5.3 | Mar 10 | Unauthorized session creation via reserved framework path access Affected: 10.0.0 through 14.14.0; 15.0.0 through 23.6.6; 24.0.0 through 24.9.7; 25.0.0 through 25.0.1 |
| CVE-2021-31412 | 5.3 | Jun 24 | Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0… Affected: 10.0.0 through 10.0.18; 11.0.0 through 13.0.0; 14.0.0 through 14.6.1; 15.0.0 through 18.0.0; 19.0.0 through 19.0.8 |
| CVE-2023-25500 | 4.3 | Jun 22 | Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in… Affected: 10.0.0 before 10.0.23; 11.0.0 before 14.10.2; 15.0.0 through 22.0.28; 23.0.0 before 23.3.14; 24.0.0 before 24.0.7; 24.1.0; +10 more |
| CVE-2021-33609 | 4.3 | Oct 13 | Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap… Affected: 8.0.0 before 8.14.1 |
| CVE-2018-25007 | 4.3 | Apr 23 | Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update… Affected: 10.0.0 before 10.0.8; 11.0.0 before 11.0.3 |
| CVE-2021-33604 | 2.5 | Jun 24 | URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through… Affected: 14.0.0 through 14.6.1; 15.0.0 through 18.0.0; 19.0.0 through 19.0.8 |
| CVE-2021-31406 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and… Affected: 15.0.0 before 18.0.7; 19.0.0 |
| CVE-2021-31404 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0… Affected: 10.0.0 before 10.0.17; 11.0.0 before 14.0.0; 14.0.0 before 14.4.7; 15.0.0 before 17.0.0; 18.0.0 before 18.0.6 |
| CVE-2021-31403 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through… Affected: 7.0.0 before 7.7.24; 8.0.0 before 8.12.3 |
| CVE-2026-110737 New | 2.3 | Oct 27 | Push Endpoint Returns Permissive CORS Headers Affected: 14.14.0 before 14.14.8; 23.6.0 before 23.6.17; 24.4.0 before 24.4.26; 24.5.0 through 24.5.15; 24.6.0 through 24.6.13; 24.7.0 before 24.7.17; +20 more |
| CVE-2011-0509 | – | Jan 20 | Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the index page Affected: through 6.4.8 |
Showing 28