CVE-2026-110803

A flaw was found in Vaadin Framework. An unauthenticated remote attacker can exploit this issue by submitting a specially crafted request containing a non-numeric identifier parameter. This malformed input triggers an unhandled exception before the application can release an internal session lock...

com.vaadin:vaadin-jandex (>=24.10.0, <=24.10.11), com.vaadin:vaadin-platform-javadoc (>=24.10.0, <=24.10.11) +5 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin (>=24.10.0, <=24.10.11)

com.vaadin:vaadin MAVEN version =24.10.0, =24.10.0, =24.10.0, =9.6.1, =9.6.1, =9.6.1, =9.6.1, =9.6.4 - io.github.adumeige.vaadin-reactflow:vaadin-reactflow-component 1.0.0 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755465...

ch.artaios:openchemlib-vaadin (>=3.0.0, <=3.0.1), ch.martinelli.oss:vaadin-jooq (2.1.3) +131 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-core (>=25.0.0, <=25.2.10)

com.vaadin:vaadin-core MAVEN version =25.0.0, =3.0.0, =2.0.0, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =1.0.0, =00.73.00, =00.78.00, =00.81.00 and more Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755466...

com.vaadin:vaadin-jandex (>=23.6.0, <=23.6.16), com.vaadin:vaadin-platform-javadoc (>=23.6.0, <=23.6.16) +1 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin (>=23.6.0, <=23.6.16)

com.vaadin:vaadin MAVEN version =23.6.0, =23.6.0, =23.6.0, =8.3.1, =8.3.4 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755465...

com.vaadin:vaadin-jandex (>=24.5.0, <=24.7.16), com.vaadin:vaadin-platform-javadoc (>=24.5.0, <=24.7.16) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin (>=24.5.0, <=24.7.16)

com.vaadin:vaadin MAVEN version =24.5.0, =24.5.0, =24.5.0, =24.7.16 - com.vaadin:vaadin-testbench-unit 9.3.15 - com.vaadin:vaadin-testbench-unit-junit5 9.3.15 - com.vaadin:vaadin-testbench-unit-quarkus 9.3.15 - com.vaadin:vaadin-testbench-unit-shared 9.3.15 Source cves: CVE-2026-110737 Source...

com.github.mcollovati:hilla-shaded-deps (>=24.4.0-beta1, <=24.4.2), com.github.mcollovati:quarkus-hilla (>=24.4.0-beta1, <=24.4.2) +7 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin (>=24.4.0, <=24.4.25)

com.vaadin:vaadin MAVEN version =24.4.0, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0, =24.4.1, =24.4.25 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755465...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by...

ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16), ch.martinelli.oss:vaadin-jooq (2.1.1) +102 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-core (>=24.5.0, <=24.7.16)

com.vaadin:vaadin-core MAVEN version =24.5.0, =0.0.15, =1.0.0, =24.5.0-alpha1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-110737 Source advisory:...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

com.vaadin:vaadin-jandex (>=24.8.0, <=24.9.23), com.vaadin:vaadin-platform-javadoc (>=24.8.0, <=24.9.23) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin (>=24.8.0, <=24.9.23)

com.vaadin:vaadin MAVEN version =24.8.0, =24.8.0, =24.8.0, =9.4.4, =9.4.4, =9.4.4, =9.4.4, =9.5.9 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755465...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by...

Permissive Cross-domain Policy with Untrusted Domains

Overview com.vaadin:vaadin-server is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response heade...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server (>=8.0.0, <=8.32.1)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755468...

com.mantledillusion.vaadin:cotton (>=3.4.0, <=3.4.1), com.mantledillusion.vaadin:cotton-core (>=3.4.0, <=3.4.1) +32 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-core (>=24.10.0, <=24.10.11)

com.vaadin:vaadin-core MAVEN version =24.10.0, =3.4.0, =3.4.0, =3.4.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =9.6.1, =9.6.1, =9.6.1, =9.6.1, =9.6.4 and more Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755466...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +150 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server (>=7.1.0, <=7.7.54)

com.vaadin:vaadin-server MAVEN version =7.1.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755468...

com.vaadin:vaadin (>=14.14.0, <=14.14.7), com.vaadin:vaadin-platform-javadoc (>=14.14.0, <=14.14.7) +1 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-core (>=14.14.0, <=14.14.7)

com.vaadin:vaadin-core MAVEN version =14.14.0, =14.14.0, =14.14.0, =14.14.0, =14.14.7 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755466...

com.vaadin:vaadin (>=23.6.0, <=23.6.16), com.vaadin:vaadin-core-jandex (>=23.6.0, <=23.6.16) +5 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-core (>=23.6.0, <=23.6.16)

com.vaadin:vaadin-core MAVEN version =23.6.0, =23.6.0, =23.6.0, =23.6.0, =23.6.0, =23.6.0, =23.6.0, =8.3.1, =8.3.4 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755466...

ch.artaios:openchemlib-vaadin (>=2.0.0, <=2.4.1), com.flowingcode.vaadin.addons:lite-renderer-addon (0.0.1) +49 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-core (>=24.4.0, <=24.4.25)

com.vaadin:vaadin-core MAVEN version =24.4.0, =2.0.0, =24.4.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =14.0.0, =14.0.0, =14.0.0, =14.0.0, =14.0.0, =14.0.3 and more Source cves: CVE-2026-110737 Source advisory:...

com.vaadin:mpr-v7 (>=7.0.0, <=8.0.1), com.vaadin:vaadin-cdi (1.9.0) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=7.7.37, <=7.7.54)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =7.7.37, =7.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.5.0 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755469...

com.appjars:appjars-ai-support-flow (1.0.0), com.appjars:appjars-flow-utils (1.0.0) +116 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-core (>=24.8.0, <=24.9.23)

com.vaadin:vaadin-core MAVEN version =24.8.0, =1.0.0, =0.1.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.9.6 - com.holon-platform.artisan:holon-artisan-demo 3.0.3 - com.holon-platform.artisan:holon-artisan-vaadin-flow-app-layout 3.0.3 -...