com.vaadin:vaadin vulnerabilities
CVEs whose affected-version data names the com.vaadin:vaadin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-110737Low· 2.3Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_OR…
CVE-2026-107588High· 8.4Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsof…
CVE-2026-93547Medium· 5.3A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that a…
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that a…
CVE-2026-91860Medium· 6.3A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes ont…
CVE-2025-9467Medium· 5.3When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation
When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that …