Known Vulnerabilities for Vaadin by Vendor
Listed below are 10 of the newest known vulnerabilities associated with "Vaadin" by "Vendor".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-120350 json | The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DO... | Not Provided | 2026-11-10 | 2026-11-10 |
| CVE-2026-120326 json | DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without es... | Not Provided | 2026-11-10 | 2026-11-10 |
| CVE-2026-110974 json | The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONToken... | Not Provided | 2026-10-22 | 2026-10-30 |
| CVE-2026-110803 json | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the bl... | Not Provided | 2026-10-21 | 2026-10-30 |
| CVE-2026-110737 json | The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Ori... | Not Provided | 2026-10-27 | 2026-11-04 |
| CVE-2026-107588 json | Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0... | Not Provided | 2026-10-21 | 2026-10-30 |
| CVE-2026-93547 json | A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders... | Not Provided | 2026-09-30 | 2026-09-30 |
| CVE-2026-91860 json | A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an o... | Not Provided | 2026-09-30 | 2026-09-30 |
| CVE-2026-7860 json | A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the f... | Not Provided | 2026-05-19 | 2026-09-14 |
| CVE-2025-9467 json | When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the u... | Not Provided | 2025-09-04 | 2026-09-14 |