com.vaadin:vaadin-server-mpr-jakarta vulnerabilities
CVEs whose affected-version data names the com.vaadin:vaadin-server-mpr-jakarta package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-110737Low· 2.3Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_OR…
▾ Sunlitvaadin · com.vaadin:vaadinvia CVEORG
CVE-2026-110803High· 8.7Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the sessi…
▾ Twilightvaadin · com.vaadin:vaadin-serverEPSS 0.28%via CVEORG