# com.vaadin:vaadin-server (Maven) vulnerabilities

7 known vulnerabilities (1 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/com.vaadin/vaadin-server

## Advisories (7)

### [CVE-2026-110737](https://cve.now/CVE-2026-110737): Push Endpoint Returns Permissive CORS Headers

- Severity: Low 2.3
- Published: Oct 27, 2026
- Affected: from 7.1.0, fixed in 7.7.55; from 8.0.0, fixed in 8.32.2.

### [CVE-2025-15022](https://cve.now/CVE-2025-15022): Cross-site scripting in Action caption

- Severity: Medium 4.8
- Published: Jan 5, 2026
- Affected: from 7.0.0, through 7.7.49; from 8.0.0, through 8.29.1; from 7.0.0, fixed in 7.7.50; from 8.0.0, fixed in 8.30.0.

### [CVE-2025-9467](https://cve.now/CVE-2025-9467): Possibility to bypass file upload validation on the server-side

- Severity: Medium 5.3
- Published: Sep 4, 2025
- Affected: from 7.0.0, through 7.7.47; from 8.0.0, through 8.28.1; from 7.0.0, fixed in 7.7.48; from 8.0.0, fixed in 8.28.2.

### [CVE-2021-33609](https://cve.now/CVE-2021-33609): Denial of service in DataCommunicator class in Vaadin 8

- Severity: Medium 4.3
- Published: Oct 13, 2021
- Affected: from 8.0.6, fixed in 8.14.1.

### [CVE-2021-31403](https://cve.now/CVE-2021-31403): Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8

- Severity: Medium 4.0
- Published: Apr 23, 2021
- Affected: from 7.0.0, fixed in 7.7.24; from 8.0.0, fixed in 8.12.3.

### [CVE-2020-36320](https://cve.now/CVE-2020-36320): Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7

- Severity: High 7.5
- Published: Apr 23, 2021
- Affected: from 7.0.0.beta1, fixed in 7.7.22.

### [CVE-2019-25028](https://cve.now/CVE-2019-25028): Stored cross-site scripting in Grid component in Vaadin 7 and 8

- Severity: Medium 5.4
- Published: Apr 23, 2021
- Affected: from 7.4.0, fixed in 7.7.20; from 8.0.0, fixed in 8.8.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/com.vaadin:vaadin-server
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.