com.vaadin:flow-server (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package com.vaadin:flow-server, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (10)

• CVE-2021-31407 — CVSS 8.6 (high): Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through…
• CVE-2019-25027 — CVSS 6.1 (medium): Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0…
• CVE-2020-36321 — CVSS 5.9 (medium): Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2)…
• CVE-2023-25499 — CVSS 5.7 (medium): When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0…
• CVE-2026-2742 — CVSS 5.3 (medium): An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0…
• CVE-2021-31406 — CVSS 4.0 (medium): Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin…
• CVE-2021-31404 — CVSS 4.0 (medium): Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0…
• CVE-2023-25500 — CVSS 3.5 (low): Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6…
• CVE-2020-36319 — CVSS 3.1 (low): Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may…
• CVE-2018-25007 — CVSS 2.6 (low): Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0…