vaadin records

26 published records for vendor vaadin.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 92.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

26 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2021-31407No exploit	Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19vaadin · flow · CWE-402 Pre-auth	High7.5	—	2.3%	Apr 23, 2021
31Monitor	CVE-2020-36320No exploit	Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7vaadin · vaadin · CWE-400 Pre-auth Denial of service	High7.5	—	1.9%	Apr 23, 2021
31Monitor	CVE-2021-31410No exploit	Project sources exposure in Vaadin Designervaadin · designer · CWE-402 Pre-auth	High7.5	—	1.6%	Apr 23, 2021
31Monitor	CVE-2021-31409No exploit	Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19vaadin · vaadin · CWE-400 Pre-auth Denial of service	High7.5	—	1.6%	May 6, 2021
31Monitor	CVE-2021-31411No exploit	Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19vaadin · flow · CWE-379	High7.8	—	0.2%	May 5, 2021
30Monitor	CVE-2020-36321No exploit	Directory traversal in development mode handler in Vaadin 14 and 15-17vaadin · flow · CWE-22 Pre-auth Path traversal	High7.5	—	1.2%	Apr 23, 2021
30Monitor	CVE-2021-31405No exploit	Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17vaadin · flow · CWE-400 Pre-auth Denial of service	High7.5	—	1.1%	Apr 23, 2021
30Monitor	CVE-2022-29567No exploit	Possible information disclosure inside TreeGrid component with default data providervaadin · vaadin · CWE-200 Pre-auth Info leak	High7.5	—	1.0%	May 24, 2022
28Monitor	CVE-2021-31408No exploit	Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19vaadin · flow · CWE-613 CSRF	High7.1	—	0.3%	Apr 23, 2021
26Monitor	CVE-2020-36319No exploit	Potential sensitive data exposure in applications using Vaadin 15vaadin · flow · CWE-200 Info leak	Medium6.5	—	1.0%	Apr 23, 2021
26Monitor	CVE-2023-25499No exploit	Possible information disclosure in non visible componentsvaadin · vaadin · CWE-200 Info leak	Medium6.5	—	0.5%	Jun 22, 2023
24Monitor	CVE-2021-33611No exploit	Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14vaadin · vaadin · CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	Nov 2, 2021
24Monitor	CVE-2019-25028No exploit	Stored cross-site scripting in Grid component in Vaadin 7 and 8vaadin · vaadin · CWE-80 Pre-auth XSS	Medium6.1	—	0.9%	Apr 23, 2021
24Monitor	CVE-2019-25027No exploit	Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13vaadin · flow · CWE-81 Pre-auth XSS	Medium6.1	—	0.6%	Apr 23, 2021
21Monitor	CVE-2021-31412No exploit	Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19vaadin · flow · CWE-1295 Pre-auth	Medium5.3	—	1.3%	Jun 24, 2021
21Monitor	CVE-2026-2742No exploit	Unauthorized session creation via reserved framework path accessvaadin · vaadin · CWE-284 Auth bypass Broken access control (IDOR)	Medium5.3	—	0.4%	Mar 10, 2026
18Monitor	CVE-2011-0509No exploit	Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown vvaadin · vaadin · CWE-79 Pre-auth XSS	Medium4.3	—	2.0%	Jan 20, 2011
17Monitor	CVE-2021-33609No exploit	Denial of service in DataCommunicator class in Vaadin 8vaadin · vaadin · CWE-400 Denial of service	Medium4.3	—	0.9%	Oct 13, 2021
17Monitor	CVE-2021-33605No exploit	Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20vaadin · vaadin-checkbox-flow · CWE-754	Medium4.3	—	0.6%	Aug 25, 2021
17Monitor	CVE-2018-25007No exploit	Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11vaadin · flow · CWE-754	Medium4.3	—	0.5%	Apr 23, 2021
17Monitor	CVE-2023-25500No exploit	Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1vaadin · vaadin · CWE-200 Info leak	Medium4.3	—	0.5%	Jun 22, 2023
10Monitor	CVE-2021-31403No exploit	Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8vaadin · vaadin · CWE-208 CSRF	Low2.5	—	0.3%	Apr 23, 2021
10Monitor	CVE-2021-33604No exploit	Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19vaadin · flow-server · CWE-172 RCE XSS	Low2.5	—	0.2%	Jun 24, 2021
10Monitor	CVE-2021-31406No exploit	Timing side channel vulnerability in endpoint request handler in Vaadin 15-19vaadin · flow · CWE-208 CSRF	Low2.5	—	0.2%	Apr 23, 2021
10Monitor	CVE-2021-31404No exploit	Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18vaadin · flow · CWE-208 CSRF	Low2.5	—	0.2%	Apr 23, 2021

CVE-2021-31407
31Monitor
Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
vaadin · flowApr 23, 2021
CVE-2020-36320
31Monitor
Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
vaadin · vaadinApr 23, 2021
CVE-2021-31410
31Monitor
Project sources exposure in Vaadin Designer
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
vaadin · designerApr 23, 2021
CVE-2021-31409
31Monitor
Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
vaadin · vaadinMay 6, 2021
CVE-2021-31411
31Monitor
Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
HighCVSS 7.8No exploitEPSS 0%
vaadin · flowMay 5, 2021
CVE-2020-36321
30Monitor
Directory traversal in development mode handler in Vaadin 14 and 15-17
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Path traversal
vaadin · flowApr 23, 2021
CVE-2021-31405
30Monitor
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
vaadin · flowApr 23, 2021
CVE-2022-29567
30Monitor
Possible information disclosure inside TreeGrid component with default data provider
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
vaadin · vaadinMay 24, 2022
CVE-2021-31408
28Monitor
Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
HighCVSS 7.1No exploitEPSS 0%
- CSRF
vaadin · flowApr 23, 2021
CVE-2020-36319
26Monitor
Potential sensitive data exposure in applications using Vaadin 15
MediumCVSS 6.5No exploitEPSS 1%
- Info leak
vaadin · flowApr 23, 2021
CVE-2023-25499
26Monitor
Possible information disclosure in non visible components
MediumCVSS 6.5No exploitEPSS 0%
- Info leak
vaadin · vaadinJun 22, 2023
CVE-2021-33611
24Monitor
Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
vaadin · vaadinNov 2, 2021
CVE-2019-25028
24Monitor
Stored cross-site scripting in Grid component in Vaadin 7 and 8
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
vaadin · vaadinApr 23, 2021
CVE-2019-25027
24Monitor
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
vaadin · flowApr 23, 2021
CVE-2021-31412
21Monitor
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
vaadin · flowJun 24, 2021
CVE-2026-2742
21Monitor
Unauthorized session creation via reserved framework path access
MediumCVSS 5.3No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
vaadin · vaadinMar 10, 2026
CVE-2011-0509
18Monitor
Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown v
MediumCVSS 4.3No exploitEPSS 2%
- Pre-auth
- XSS
vaadin · vaadinJan 20, 2011
CVE-2021-33609
17Monitor
Denial of service in DataCommunicator class in Vaadin 8
MediumCVSS 4.3No exploitEPSS 0%
- Denial of service
vaadin · vaadinOct 13, 2021
CVE-2021-33605
17Monitor
Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
MediumCVSS 4.3No exploitEPSS 0%
vaadin · vaadin-checkbox-flowAug 25, 2021
CVE-2018-25007
17Monitor
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
MediumCVSS 4.3No exploitEPSS 0%
vaadin · flowApr 23, 2021
CVE-2023-25500
17Monitor
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1
MediumCVSS 4.3No exploitEPSS 0%
- Info leak
vaadin · vaadinJun 22, 2023
CVE-2021-31403
10Monitor
Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8
LowCVSS 2.5No exploitEPSS 0%
- CSRF
vaadin · vaadinApr 23, 2021
CVE-2021-33604
10Monitor
Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
LowCVSS 2.5No exploitEPSS 0%
- RCE
- XSS
vaadin · flow-serverJun 24, 2021
CVE-2021-31406
10Monitor
Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
LowCVSS 2.5No exploitEPSS 0%
- CSRF
vaadin · flowApr 23, 2021
CVE-2021-31404
10Monitor
Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
LowCVSS 2.5No exploitEPSS 0%
- CSRF
vaadin · flowApr 23, 2021