Skip to content
OpenAdvisories

Product · vaadin

flow-server

11 known vulnerabilities.

flow-server at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Medium 5.7
    CVE-2023-25499

    Possible information disclosure in non visible components

    When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resu…

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Medium 5.3
    CVE-2021-31412

    Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

    Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0…

    vaadin vaadin flow-server com.vaadin:vaadin-bom Maven
  • Low 2.5
    CVE-2021-33604

    Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

    URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted …

    vaadin vaadin flow-server com.vaadin:vaadin-bom Maven
  • Medium 6.3
    CVE-2021-31411

    Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

    Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) a…

    vaadin vaadin flow-server com.vaadin:vaadin-bom Maven
  • High 8.6
    CVE-2021-31407

    Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

    Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Medium 4.0
    CVE-2021-31404

    Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

    Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.…

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Medium 4.0
    CVE-2021-31406

    Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

    Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security tok…

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Medium 5.9
    CVE-2020-36321

    Directory traversal in development mode handler in Vaadin 14 and 15-17

    Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended front…

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Low 3.1
    CVE-2020-36319

    Potential sensitive data exposure in applications using Vaadin 15

    Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Low 2.6
    CVE-2018-25007

    Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

    Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Medium 6.1
    CVE-2019-25027

    Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

    Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via …

    vaadin vaadin flow-server com.vaadin:flow-server Maven