Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.vaadin:vaadin

8 known vulnerabilities (5 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 5 medium, 3 low
Registry
Maven Central

Advisories 8

  • Push Endpoint Returns Permissive CORS Headers

    Affected: from 14.14.0, fixed in 14.14.8; from 23.6.0, fixed in 23.6.17; from 24.4.0, fixed in 24.4.26; from 24.5.0, through 24.5.15; from 24.6.0, through 24.6.13; from 24.7.0, fixed in 24.7.17; from 24.8.0, through 24.8.17; from 24.9.0, fixed in 24.9.24; from 24.10.0, fixed in 24.10.12; from 25.0.0, through 25.0.13; from 25.1.0, through 25.1.13; from 25.2.0, fixed in 25.2.11; from 25.3.0, fixed in 25.3.3.

  • CVE-2026-2742Medium 5.3

    Unauthorized session creation via reserved framework path access

    Affected: from 10.0.0, through 14.14.0; from 15.0.0, through 23.6.6; from 24.0.0, through 24.9.7; from 25.0.0, through 25.0.1; from 25.0.0, fixed in 25.0.2; from 24.0.0, fixed in 24.9.8; from 23.0.0, fixed in 23.6.7; fixed in 14.14.1.

  • Zip Slip Path Traversal on Node Unpack

    Affected: from 14.2.0, through 14.14.0; from 15.0.0, through 23.6.6; from 24.0.0, through 24.9.8; from 25.0.0, through 25.0.2.

  • CVE-2025-15022Medium 4.8

    Cross-site scripting in Action caption

    Affected: from 23.1.0, through 23.6.5; from 24.0.0, through 24.8.13; from 24.9.0, through 24.9.6; from 23.1.0, fixed in 23.6.6; from 24.0.0, fixed in 24.8.14; from 24.9.0, fixed in 24.9.7.

  • CVE-2025-9467Medium 5.3

    Possibility to bypass file upload validation on the server-side

    Affected: from 14.0.0, through 14.13.0; from 23.0.0, through 23.6.1; from 24.0.0, through 24.7.6.

  • Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6…

    Affected: from 10.0.0, through 10.0.23; from 11.0.0, through 14.10.1; from 15.0.0, through 22.0.28; from 23.0.0, through 23.3.13; from 24.0.0, through 24.0.6; from 24.1.0.alpha1, through 24.1.0.rc2; from 10.0.0, fixed in 10.0.24; from 11.0.0, fixed in 14.10.2; from 15.0.0, fixed in 22.1.0; from 23.0.0, fixed in 23.3.14; from 24.0.0, fixed in 24.0.7; from 24.1.0.alpha1, fixed in 24.1.0.

  • CVE-2023-25499Medium 5.7

    Possible information disclosure in non visible components

    Affected: from 10.0.0, fixed in 10.0.23; from 11.0.0, fixed in 14.10.1; from 23.0.0, fixed in 23.3.13; from 24.0.0, fixed in 24.0.6; from 24.1.0.alpha1, fixed in 24.1.0.

  • CVE-2022-29567Medium 5.7

    Possible information disclosure inside TreeGrid component with default data provider

    Affected: from 14.8.5, through 14.8.9; from 22.0.6, through 22.0.14; from 23.0.0.beta2, through 23.0.8; from 23.1.0.alpha1, fixed in 23.1.0.beta1; from 14.8.5, fixed in 14.8.10; from 22.0.6, fixed in 22.0.15; from 23.0.0, fixed in 23.0.9.