com.vaadin:vaadin-core vulnerabilities
CVEs whose affected-version data names the com.vaadin:vaadin-core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-110737Low· 2.3Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_OR…
▾ Sunlitvaadin · com.vaadin:vaadinvia CVEORG
CVE-2026-91860Medium· 6.3A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes ont…
▾ Sunlitvaadin · com.vaadin:vaadinEPSS 0.47%via NVD