Skip to content
OpenAdvisories

Product · vaadin

framework

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.3
    CVE-2026-110737

    Push Endpoint Returns Permissive CORS Headers

    The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to fal…

    vaadin vaadin flow framework