Vaadin vulnerabilities
Every vulnerability this feed holds for Vaadin, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
3 vulnerabilities tracked.
- 5.1 The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM.
- 4.8 DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it.
- 2.3 The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Vaadin is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Linux Red Hat IBM Microsoft Apple Apache Software Foundation Google n/a Oracle Corporation zephyrproject Unknown FFMPEG JetBrains OpenEMR Drupal SAP_SE Cisco Eclipse Foundation go-vikunja hickory-dns n8n-io Hitachi Samsung Semiconductor Tanium