Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.vaadin:vaadin-server

7 known vulnerabilities (1 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 high, 5 medium, 1 low
Registry
Maven Central

Advisories 7

  • Push Endpoint Returns Permissive CORS Headers

    Affected: from 7.1.0, fixed in 7.7.55; from 8.0.0, fixed in 8.32.2.

  • CVE-2025-15022Medium 4.8

    Cross-site scripting in Action caption

    Affected: from 7.0.0, through 7.7.49; from 8.0.0, through 8.29.1; from 7.0.0, fixed in 7.7.50; from 8.0.0, fixed in 8.30.0.

  • CVE-2025-9467Medium 5.3

    Possibility to bypass file upload validation on the server-side

    Affected: from 7.0.0, through 7.7.47; from 8.0.0, through 8.28.1; from 7.0.0, fixed in 7.7.48; from 8.0.0, fixed in 8.28.2.

  • CVE-2021-33609Medium 4.3

    Denial of service in DataCommunicator class in Vaadin 8

    Affected: from 8.0.6, fixed in 8.14.1.

  • CVE-2021-31403Medium 4.0

    Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8

    Affected: from 7.0.0, fixed in 7.7.24; from 8.0.0, fixed in 8.12.3.

  • Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7

    Affected: from 7.0.0.beta1, fixed in 7.7.22.

  • CVE-2019-25028Medium 5.4

    Stored cross-site scripting in Grid component in Vaadin 7 and 8

    Affected: from 7.4.0, fixed in 7.7.20; from 8.0.0, fixed in 8.8.5.