https://vulnogram.org/ Most recent CVEs assigned by Vaadin Ltd. (vaadin). https://vulnogram.org/seaview/icons/vaadin.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-93547 https://vulnogram.org/CVE-2026-93547 A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Wr… Medium Wed, 30 Sep 2026 13:13:13 GMT https://vulnogram.org/CVE-2026-91860 https://vulnogram.org/CVE-2026-91860 A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prot… Medium Network Exploitable Wed, 30 Sep 2026 13:13:05 GMT https://vulnogram.org/CVE-2026-7860 https://vulnogram.org/CVE-2026-7860 A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the… Low Tue, 19 May 2026 11:01:47 GMT https://vulnogram.org/CVE-2026-2742 https://vulnogram.org/CVE-2026-2742 An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework… Medium Tue, 10 Mar 2026 12:08:48 GMT https://vulnogram.org/CVE-2026-2741 https://vulnogram.org/CVE-2026-2741 Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can a… Low Tue, 10 Mar 2026 12:08:30 GMT https://vulnogram.org/CVE-2025-15022 https://vulnogram.org/CVE-2025-15022 Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may… Medium Mon, 05 Jan 2026 07:52:56 GMT https://vulnogram.org/CVE-2025-9467 https://vulnogram.org/CVE-2025-9467 When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this… Medium Thu, 04 Sep 2025 06:15:47 GMT https://vulnogram.org/CVE-2023-25500 https://vulnogram.org/CVE-2023-25500 Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC respon… Low Thu, 22 Jun 2023 12:49:06 GMT https://vulnogram.org/CVE-2023-25499 https://vulnogram.org/CVE-2023-25499 When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.be… Medium Thu, 22 Jun 2023 12:47:57 GMT https://vulnogram.org/CVE-2022-29567 https://vulnogram.org/CVE-2022-29567 The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4,… Medium Tue, 24 May 2022 14:20:19 GMT https://vulnogram.org/CVE-2021-33611 https://vulnogram.org/CVE-2021-33611 Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL Medium Network Exploitable Tue, 02 Nov 2021 10:06:56 GMT https://vulnogram.org/CVE-2021-33609 https://vulnogram.org/CVE-2021-33609 Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data. Medium Wed, 13 Oct 2021 10:58:35 GMT https://vulnogram.org/CVE-2021-33605 https://vulnogram.org/CVE-2021-33605 Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 throug… Medium Wed, 25 Aug 2021 12:12:41 GMT https://vulnogram.org/CVE-2021-31412 https://vulnogram.org/CVE-2021-31412 Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1)… Medium Network Exploitable Thu, 24 Jun 2021 11:33:10 GMT https://vulnogram.org/CVE-2021-33604 https://vulnogram.org/CVE-2021-33604 URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening… Low Thu, 24 Jun 2021 11:16:27 GMT https://vulnogram.org/CVE-2021-31409 https://vulnogram.org/CVE-2021-31409 Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious ema… High Network Exploitable Wed, 05 May 2021 19:07:30 GMT https://vulnogram.org/CVE-2021-31411 https://vulnogram.org/CVE-2021-31411 Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through… Medium Wed, 05 May 2021 18:15:13 GMT https://vulnogram.org/CVE-2021-31410 https://vulnogram.org/CVE-2021-31410 Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request. High Network Exploitable Fri, 23 Apr 2021 16:08:31 GMT https://vulnogram.org/CVE-2021-31408 https://vulnogram.org/CVE-2021-31408 Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows… Medium Fri, 23 Apr 2021 16:07:16 GMT https://vulnogram.org/CVE-2021-31407 https://vulnogram.org/CVE-2021-31407 Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTT… High Network Exploitable Fri, 23 Apr 2021 16:05:41 GMT https://vulnogram.org/CVE-2021-31406 https://vulnogram.org/CVE-2021-31406 Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a sec… Medium Fri, 23 Apr 2021 16:05:41 GMT https://vulnogram.org/CVE-2021-31405 https://vulnogram.org/CVE-2021-31405 Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource… High Network Exploitable Fri, 23 Apr 2021 16:05:41 GMT https://vulnogram.org/CVE-2021-31404 https://vulnogram.org/CVE-2021-31404 Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4… Medium Fri, 23 Apr 2021 16:05:41 GMT https://vulnogram.org/CVE-2021-31403 https://vulnogram.org/CVE-2021-31403 Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security to… Medium Fri, 23 Apr 2021 16:05:41 GMT https://vulnogram.org/CVE-2020-36321 https://vulnogram.org/CVE-2020-36321 Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of inten… Medium Network Exploitable Fri, 23 Apr 2021 16:05:40 GMT https://vulnogram.org/CVE-2020-36320 https://vulnogram.org/CVE-2020-36320 Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. High Network Exploitable Fri, 23 Apr 2021 16:05:40 GMT https://vulnogram.org/CVE-2020-36319 https://vulnogram.org/CVE-2020-36319 Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController Low Fri, 23 Apr 2021 16:05:40 GMT https://vulnogram.org/CVE-2019-25028 https://vulnogram.org/CVE-2019-25028 Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecifi… Medium Network Exploitable Fri, 23 Apr 2021 16:05:40 GMT https://vulnogram.org/CVE-2019-25027 https://vulnogram.org/CVE-2019-25027 Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaSc… Medium Network Exploitable Fri, 23 Apr 2021 16:05:40 GMT https://vulnogram.org/CVE-2018-25007 https://vulnogram.org/CVE-2018-25007 Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message. Low Fri, 23 Apr 2021 16:05:40 GMT