Vulnerabilities in Vaadin
34 resultsCVE-2025-9467MEDIUMPossibility to bypass file upload validation on the server-sideEPSS 0.4%CVE-2026-2741LOWZip Slip Path Traversal on Node UnpackEPSS 0.4%CVE-2026-93547MEDIUMMissing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked CellsEPSS 0.4%CVE-2025-15022MEDIUMCross-site scripting in Action captionEPSS 0.3%CVE-2026-110974MEDIUMUncontrolled Recursion on Nested JSON Allows Denial of Service in android-jsonEPSS 0.3%CVE-2021-31408MEDIUMServer session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19EPSS 0.3%CVE-2021-31403MEDIUMTiming side channel vulnerability in UIDL request handler in Vaadin 7 and 8EPSS 0.3%CVE-2021-33604LOWReflected cross-site scripting in development mode handler in Vaadin 14, 15-19EPSS 0.3%CVE-2026-110803HIGHSession Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8EPSS 0.3%CVE-2021-31411MEDIUMInsecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19EPSS 0.2%CVE-2021-31406MEDIUMTiming side channel vulnerability in endpoint request handler in Vaadin 15-19EPSS 0.2%CVE-2021-31404MEDIUMTiming side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18EPSS 0.2%CVE-2026-110737LOWPush Endpoint Returns Permissive CORS HeadersEPSS 0.2%CVE-2026-7860LOWPossible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend BuildEPSS 0.1%