Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.vaadin:flow-server

12 known vulnerabilities (1 high, 6 medium, 5 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 1 high, 6 medium, 5 low
Registry
Maven Central

Advisories 12

  • Push Endpoint Returns Permissive CORS Headers

    Affected: from 2.13.0, fixed in 2.13.8; from 23.6.0, fixed in 23.6.16; from 24.4.0, fixed in 24.4.19; from 24.5.0, through 24.5.17; from 24.6.0, through 24.6.14; from 24.7.0, fixed in 24.7.16; from 24.8.0, through 24.8.16; from 24.9.0, fixed in 24.9.29; from 24.10.0, fixed in 24.10.15; from 25.0.0, through 25.0.15; from 25.1.0, fixed in 25.1.19; from 25.2.0, fixed in 25.2.13; from 25.3.0, fixed in 25.3.4.

  • CVE-2026-2742Medium 5.3

    Unauthorized session creation via reserved framework path access

    Affected: from 1.0.0, through 2.13.0; from 3.0.0, through 23.6.7; from 24.0.0, through 24.9.7; from 25.0.0, fixed in 25.0.1; fixed in 14.14.1; from 23.0.0, fixed in 23.6.7; from 24.0.0, fixed in 24.9.8; from 25.0.0, fixed in 25.0.2.

  • Zip Slip Path Traversal on Node Unpack

    Affected: from 2.2.0, through 2.13.0; from 3.0.0, through 23.6.7; from 24.0.0, through 24.9.9.

  • Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6…

    Affected: from 1.0.0, through 1.0.20; from 1.1.0, through 2.9.2; from 3.0.0, through 9.1.1; from 23.0.0, through 23.3.12; from 24.0.0, through 24.0.8; from 24.1.0.alpha1, through 24.1.0.rc3; from 1.0.0, fixed in 1.0.21; from 1.1.0, fixed in 2.9.3; from 3.0.0, fixed in 9.1.2; from 23.0.0, fixed in 23.3.13; from 24.0.0, fixed in 24.0.9; from 24.1.alpha1, fixed in 24.1.0.

  • CVE-2023-25499Medium 5.7

    Possible information disclosure in non visible components

    Affected: from 1.0.0, fixed in 1.0.20; from 1.1.0, fixed in 2.8.10; from 3.0.0, fixed in 9.1.1; from 23.0.0, fixed in 23.3.11; from 24.0.0, fixed in 24.0.8; from 24.1.0.alpha1, fixed in 24.1.0.

  • Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

    Affected: from 1.2.0, fixed in 2.4.8; from 6.0.0, fixed in 6.0.1.

  • CVE-2021-31406Medium 4.0

    Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

    Affected: from 3.0.0, fixed in 5.0.4; from 6.0.0, fixed in 6.0.1.

  • CVE-2021-31404Medium 4.0

    Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

    Affected: from 1.0.0, fixed in 1.0.14; from 1.1.0, fixed in 2.4.7; from 3.0.0, fixed in 5.0.3.

  • CVE-2020-36321Medium 5.9

    Directory traversal in development mode handler in Vaadin 14 and 15-17

    Affected: from 3.0.0, fixed in 5.0.0; from 2.0.0, fixed in 2.4.2.

  • Potential sensitive data exposure in applications using Vaadin 15

    Affected: from 3.0.0, fixed in 3.0.6.

  • CVE-2019-25027Medium 6.1

    Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

    Affected: from 1.0.0, fixed in 1.0.11; from 1.1.0, fixed in 1.4.3.

  • Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

    Affected: from 1.0.0, fixed in 1.0.6.