[ Vendor · 5 CVEs ]
vaadin
CVEs affecting vaadin published in the last 30 days, plus any vaadin CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110974 | 22 Oct 2026 | CVSS 6.3 | vaadin android-jsonThe org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls… | |
| CVE-2026-110803 | 21 Oct 2026 | CVSS 8.7 | vaadin frameworkVaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the… | |
| CVE-2026-107588 | 21 Oct 2026 | CVSS 8.4 | vaadinVaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an… | |
| CVE-2026-91860 | 30 Sep 2026 | CVSS 6.3 | vaadinA prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application… | |
| CVE-2026-93547 | 30 Sep 2026 | CVSS 5.3 | vaadinA missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or… |