What’s Vulnerable › Products

vaadin flow vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your vaadin flow version is affected

Latest vaadin flow vulnerabilities

• CVE-2026-7860 — Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build (CVSS 1.6)
• CVE-2021-31412 — Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 (CVSS 5.3)
• CVE-2021-31411 — Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 (CVSS 7.8)
• CVE-2021-31408 — Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 (CVSS 7.1)
• CVE-2021-31407 — Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 (CVSS 7.5)
• CVE-2021-31406 — Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 (CVSS 2.5)
• CVE-2021-31405 — Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 (CVSS 7.5)
• CVE-2021-31404 — Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 (CVSS 2.5)
• CVE-2020-36321 — Directory traversal in development mode handler in Vaadin 14 and 15-17 (CVSS 7.5)
• CVE-2020-36319 — Potential sensitive data exposure in applications using Vaadin 15 (CVSS 6.5)
• CVE-2019-25027 — Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 (CVSS 6.1)
• CVE-2018-25007 — Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 (CVSS 4.3)