812 matches found
CVE-2026-120350
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120326
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
CVE-2026-120350 Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350
The Vaadin Rich Text Editor is vulnerable to Stored Cross-Site Scripting (XSS) due to an unescaped video embed export. The component fails to escape values during export and subsequently parses the resulting HTML into the live DOM, allowing a crafted payload to break out of the href attribute. Th...
EUVD-2026-120894
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350 Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120326 Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
CVE-2026-120326
Vaadin Flow is vulnerable to a Content-Disposition parameter injection due to unescaped file names in the DownloadEvent.setFileName(String) method. When an application processes untrusted filenames, an attacker can insert a double quote to prematurely terminate the filename attribute and inject a...
EUVD-2026-120893
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
CVE-2026-120326
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
CVE-2026-120326 Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
PT-2026-141592
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
Stored cross-site scripting in the Vaadin Rich Text Editor via an unescaped video embed
The Vaadin Rich Text Editor exports a video embed without escaping its value and then parses the resulting HTML into live DOM, so a crafted embed runs script in the browser of anyone who opens the page. Only content persisted through asDelta is affected: the default HTML value is sanitized on the...
Unescaped download file name allows Content-Disposition parameter injection in Vaadin Flow
DownloadEvent.setFileName writes the download file name into the Content-Disposition header without escaping it, so an application that passes a file name it did not generate lets an attacker add their own header parameters and have the file saved under a name and extension of the attacker's...
CVE-2026-120326: vaadin: DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header…
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename=" " with the name inserted verbatim, so a double quote in the name ends the quoted strin...
PT-2026-141593
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350: vaadin: The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into…
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-107588
A flaw was found in Vaadin Charts. Untrusted input passed into chart configuration settings can trigger vulnerabilities in the bundled chart rendering library, enabling an attacker to perform Cross-Site Scripting XSS and prototype pollution. A remote attacker who can control chart configuration...
CVE-2026-110803
A flaw was found in Vaadin Framework. An unauthenticated remote attacker can exploit this issue by submitting a specially crafted request containing a non-numeric identifier parameter. This malformed input triggers an unhandled exception before the application can release an internal session lock...