Skip to content
OpenAdvisories

Product · vaadin

flow

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-110737

    Push Endpoint Returns Permissive CORS Headers

    The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to fal…

    vaadin vaadin flow framework
  • Low 1.6
    CVE-2026-7860

    Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build

    A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build env…

    vaadin flow com.vaadin:flow-gradle-plugin com.vaadin:flow-maven-plugin Maven
  • Low 2.3
    CVE-2026-2741

    Zip Slip Path Traversal on Node Unpack

    Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatica…

    vaadin vaadin flow com.vaadin:flow-project Maven