Skip to content
OpenAdvisories

Product · vaadin

flow

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-120326

    Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow

    DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="<name>" with the name inserted verbatim, so a d…

    vaadin vaadin flow vaadin-core
  • Medium 5.3
    CVE-2026-2742

    Unauthorized session creation via reserved framework path access

    An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. A…

    vaadin vaadin flow com.vaadin:flow-server Maven