Read the docs

Vaadin

Records35All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Vaadin records in CISA KEV

No Vaadin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Vaadin 24 records MEDIUM Flow 11 records MEDIUM Designer 1 record MEDIUM Flow-server 1 record LOW Vaadin-checkbox-flow 1 record LOW Vaadin-menu-bar 1 record LOW

Records

1 record in Flow-server · all components

TI-2021-12987 CVE-2021-33604 · GHSA-c99r-67x4-whj6

Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

Priority LOW 13

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitr…

CVSS 3.1LOW 2.5 Local No auth User interaction EPSS 0.00286 Published 2021-06-24 Fixed in 14.6.2, 19.0.9 CWE-172
Open these records in search →