vaadin vulnerabilities

CVEs per yearBy the year they were published

1. 202114
2. 20213
3. 20212
4. 20211
5. 20221
6. 20232
7. 20269
8. 20262

Newest CVEs

• CVE-2026-110737

  Push Endpoint Returns Permissive CORS Headers

  vaadin · vaadin

  Low2.3
• CVE-2026-110974

  Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

  vaadin · android-json

  Medium6.3
• CVE-2026-110803

  Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

  vaadin · framework

  High8.7
• CVE-2026-107588

  Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts

  vaadin · vaadin

  High8.4
• CVE-2026-93547

  Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

  vaadin · vaadin

  Medium5.3
• CVE-2026-91860

  Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

  vaadin · vaadin

  Medium6.3
• CVE-2026-7860

  Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build

  vaadin · flow

  Low1.6
• CVE-2026-2742

  Unauthorized session creation via reserved framework path access

  vaadin · vaadin

  Medium5.3
• CVE-2026-2741

  Zip Slip Path Traversal on Node Unpack

  vaadin · vaadin

  Low2.3
• CVE-2025-15022

  Cross-site scripting in Action caption

  vaadin · vaadin

  Medium4.8