Security advisories

medium2025-09-04

Vaadin Platform possible file bypass via upload validation on the server-side

GHSA-c7v7-rqfm-f44j

medium2023-06-22

Vaadin vulnerable to possible information disclosure in non visible components.

GHSA-5f9v-mv5g-jh5q · CVE-2023-25499

low2023-06-22

Vaadin vulnerable to possible information disclosure of class and method names in RPC response

GHSA-ch48-9r3q-pv7x · CVE-2023-25500

medium2022-05-25

Possible information disclosure inside TreeGrid component with default data provider

GHSA-qfr3-323w-qv27 · CVE-2022-29567

medium2021-11-03

Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14

GHSA-93c4-vf86-3rj7 · CVE-2021-33611

low2021-04-19

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

GHSA-3h5r-928v-mxhh

medium2021-04-19

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

GHSA-jqj4-r483-4gvr

low2021-04-19

Potential sensitive data exposure in applications using Vaadin 15

GHSA-76f4-fw33-6j2v

medium2021-04-19

Directory traversal in development mode handler in Vaadin 14 and 15-17

GHSA-82mf-mmh7-hxp5

medium2021-04-19

Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

GHSA-c6c4-7x48-4cqp

medium2021-04-19

Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

GHSA-9h6g-6mxg-vvp4

high2021-04-19

Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

GHSA-j9wr-49vq-rm5g