VA
Product
vaadin
30
CVEs
0
On KEV
8.4
Max CVSS
4
New 30D
Severity mix
Critical 0High 9Medium 15Low 5
Watch
Add vaadin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-33604 | 2.5 | Jun 24 | URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through… Affected: 14.0.0 through 14.6.1; 15.0.0 through 18.0.0; 19.0.0 through 19.0.8 |
| CVE-2021-31406 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and… Affected: 15.0.0 before 18.0.7; 19.0.0 |
| CVE-2021-31404 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0… Affected: 10.0.0 before 10.0.17; 11.0.0 before 14.0.0; 14.0.0 before 14.4.7; 15.0.0 before 17.0.0; 18.0.0 before 18.0.6 |
| CVE-2021-31403 | 2.5 | Apr 23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through… Affected: 7.0.0 before 7.7.24; 8.0.0 before 8.12.3 |
| CVE-2026-110737 New | 2.3 | Oct 27 | Push Endpoint Returns Permissive CORS Headers Affected: 14.14.0 before 14.14.8; 23.6.0 before 23.6.17; 24.4.0 before 24.4.26; 24.5.0 through 24.5.15; 24.6.0 through 24.6.13; 24.7.0 before 24.7.17; +20 more |
Showing 5