com.github.mcollovati.vertx:vaadin-flow-sockjs (17.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (17.0.0) +18 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (4.0.1)

com.vaadin:flow-server MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs 17.0.0 - com.github.mcollovati.vertx:vertx-vaadin-flow 17.0.0 -...

com.github.mcollovati.vertx:vaadin-flow-sockjs (12.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (12.0.0) +28 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (1.2.5)

com.vaadin:flow-server MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs 12.0.0 - com.github.mcollovati.vertx:vertx-vaadin-flow 12.0.0 -...

com.github.mcollovati.vertx:vaadin-flow-sockjs (14.6.0), com.github.mcollovati.vertx:vertx-vaadin-flow (14.6.0) +96 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.7.11)

com.vaadin:flow-server MAVEN version 2.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs 14.6.0 - com.github.mcollovati.vertx:vertx-vaadin-flow 14.6.0 -...

com.flowingcode.vaadin.addons:twincolgrid (>=2.9.3, <=2.9.4), com.vaadin:flow (2.8.6) +92 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.8.6)

com.vaadin:flow-server MAVEN version 2.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.flowingcode.vaadin.addons:twincolgrid =2.9.3, =2.9.4 - com.vaadin:flow 2.8.6 - com.vaadin:flow-client 2.8.6 -...

MAL-2024-9443 Malicious code in sn-flow-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2c83ae0b3aa74be7de2508ec17549e3bc00e40edd30c62322e91be77ea48e69 package.json declares a preinstall hook "preinstall": "node index.js" that runs index.js automatically on npm install. index.js requires childprocess...

Malicious code in sn-flow-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2c83ae0b3aa74be7de2508ec17549e3bc00e40edd30c62322e91be77ea48e69 package.json declares a preinstall hook "preinstall": "node index.js" that runs index.js automatically on npm install. index.js requires childprocess...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vaadin-flow-sockjs (>=23.1.0, <=23.1.1) +258 more potentially affected by CVE-2023-25499 via com.vaadin:flow-server (>=23.0.0, <=23.3.10)

com.vaadin:flow-server MAVEN version =23.0.0, =1.1.3, =23.1.0, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =5.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.3.10 and more Source cves: CVE-2023-25499 Source advisory: GHSA-5F9V-MV5G-JH5Q...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.1, <=1.1.2), com.beirtipol:jfixtools-reporting (1.0-beta) +129 more potentially affected by CVE-2023-25500 via com.vaadin:flow-server (>=3.0.0, <=9.1.1)

com.vaadin:flow-server MAVEN version =3.0.0, =1.0.1, =1.1.6, =15.0.0, =15.0.0, =3.2.3, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =9.1.1 and more Source cves: CVE-2023-25500 Source advisory: GHSA-CH48-9R3Q-PV7X...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.1, <=1.1.2), com.beirtipol:jfixtools-reporting (1.0-beta) +129 more potentially affected by CVE-2023-25500 via com.vaadin:flow-server (>=3.0.0, <=9.1.1)

com.vaadin:flow-server MAVEN version =3.0.0, =1.0.1, =1.1.6, =15.0.0, =15.0.0, =3.2.3, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =9.1.1 and more Source cves: CVE-2023-25500 Source advisory: MEND:CVE-2023-25500...

com.alibaba.rsocket:alibaba-broker-server (1.0.1), com.beirtipol:jfixtools-reporting (1.0-beta) +110 more potentially affected by unknown CVE via com.vaadin:flow-server (>=3.0.0, <=6.0.5)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =6.0.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-C57F-4VP2-JQHM...

Cross site request forgery (csrf)

Authentication.logout helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 Vaadin 18, and 6.0.0 through 6.0.4 Vaadin 19.0.0 through 19.0.3 uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the...

CVE-2021-31408

The CVE-2021-31408 issue affects vaadin:flow-client: versions 5.0.0 prior to 6.0.0 (Vaadin 18) and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3). The root cause is an incorrect HTTP method in Authentication.logout() combined with Spring Security CSRF protection, which, according to the provi...

CVE-2021-31408

Authentication.logout helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 Vaadin 18, and 6.0.0 through 6.0.4 Vaadin 19.0.0 through 19.0.3 uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the...

com.beirtipol:jfixtools-reporting (1.0-beta), com.beirtipol:jfixtools-ui-vaadin (1.0-beta) +107 more potentially affected by CVE-2021-31404 via com.vaadin:flow-server (>=3.0.0, <=5.0.2)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.0.0, =5.0.2 and more Source cves: CVE-2021-31404 Source advisory: MEND:CVE-2021-31404...

Vaadin Flow code issues and vulnerabilities

Vaadin flow is a software application. a Java framework for the Vaadin platform for building modern websites that look great, perform well and keep you and your users happy. A code issue vulnerability exists in vaadin:flow-client that allows a local attacker to access Fusion endpoints after a use...

com.alibaba.rsocket:alibaba-broker-server (1.0.1), com.github.mcollovati.vertx:vaadin-flow-sockjs (>=18.0.0, <=19.0.0) +74 more potentially affected by CVE-2021-31408 via com.vaadin:flow-client (>=5.0.0, <=6.0.4)

com.vaadin:flow-client MAVEN version =5.0.0, =18.0.0, =18.0.0, =5.0.0, =5.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.7 and more Source cves: CVE-2021-31408 Source advisory: GHSA-6HGR-2G6Q-3RMC...

Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

Authentication.logout helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 Vaadin 18, and 6.0.0 through 6.0.4 Vaadin 19.0.0 through 19.0.3 uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the...

com.vaadin:flow (>=3.0.0, <=3.0.5), com.vaadin:flow-client (>=3.0.0, <=3.0.5) +87 more potentially affected by CVE-2020-36319 via com.vaadin:flow-server (>=3.0.0, <=3.0.5)

com.vaadin:flow-server MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =15.0.0, =15.0.4 - com.vaadin:vaadin-accordion-flow 3.0.0 - com.vaadin:vaadin-accordion-flow-demo 3.0.0 and more Source cves: CVE-2020-36319 Source advisory: OSV:GHSA-RJWW-2X8V-M9V...

com.beirtipol:jfixtools-reporting (1.0-beta), com.beirtipol:jfixtools-ui-vaadin (1.0-beta) +101 more potentially affected by CVE-2020-36321 via com.vaadin:flow-server (>=3.0.0, <=4.0.8)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.0.8 and more Source cves: CVE-2020-36321 Source advisory: GHSA-49R2-73M6-PP8F...

com.beirtipol:jfixtools-reporting (1.0-beta), com.beirtipol:jfixtools-ui-vaadin (1.0-beta) +107 more potentially affected by CVE-2021-31404 via com.vaadin:flow-server (>=3.0.0, <=5.0.2)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.0.0, =5.0.2 and more Source cves: CVE-2021-31404 Source advisory: GHSA-XWG3-QRCG-W9X6...