com.vaadin:hilla-maven-plugin (>=25.0.0, <=25.0.9), com.vaadin:vaadin-maven-plugin (>=25.0.0, <=25.0.9) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=25.0.0, <=25.0.10)

com.vaadin:flow-maven-plugin MAVEN version =25.0.0, =25.0.0, =25.0.0, =25.0.9 Source cves: CVE-2026-7860 Source advisory: GHSA-J8MX-J73W-9MXW...

com.vaadin:hilla-maven-plugin (>=24.4.0, <=24.9.16), com.vaadin:vaadin-maven-plugin (>=24.0.0, <=24.9.16) +1 more potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=24.0.0, <=24.9.17)

com.vaadin:flow-maven-plugin MAVEN version =24.0.0, =24.4.0, =24.0.0, =2.0.0, =24.1.15 Source cves: CVE-2026-7860 Source advisory: OSV:GHSA-J8MX-J73W-9MXW...

com.vaadin:hilla-maven-plugin (>=24.10.0-beta1, <=24.10.3), com.vaadin:vaadin-maven-plugin (>=24.10.0-beta1, <=24.10.3) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=24.10.0-beta1, <=24.10.3)

com.vaadin:flow-maven-plugin MAVEN version =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.3 Source cves: CVE-2026-7860 Source advisory: SNYK:JAVA-COMVAADIN-17176893...

com.vaadin:hilla-maven-plugin (>=24.4.0, <=24.9.15), com.vaadin:vaadin-maven-plugin (>=24.0.0, <=24.9.14) +1 more potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=24.0.0, <=24.9.16)

com.vaadin:flow-maven-plugin MAVEN version =24.0.0, =24.4.0, =24.0.0, =2.0.0, =24.1.15 Source cves: CVE-2026-7860 Source advisory: GHSA-J8MX-J73W-9MXW...

com.vaadin:hilla-maven-plugin (>=24.10.0, <=24.10.3), com.vaadin:vaadin-maven-plugin (>=24.10.0, <=24.10.3) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=24.10.0, <=24.10.3)

com.vaadin:flow-maven-plugin MAVEN version =24.10.0, =24.10.0, =24.10.0, =24.10.3 Source cves: CVE-2026-7860 Source advisory: GHSA-J8MX-J73W-9MXW...

com.vaadin:hilla-maven-plugin (>=25.1.0, <=25.1.3), com.vaadin:vaadin-maven-plugin (>=25.1.0, <=25.1.4) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=25.1.0, <=25.1.4)

com.vaadin:flow-maven-plugin MAVEN version =25.1.0, =25.1.0, =25.1.0, =25.1.4 Source cves: CVE-2026-7860 Source advisory: GHSA-J8MX-J73W-9MXW...

com.vaadin:vaadin-maven-plugin (>=23.0.0, <=23.6.9), dev.hilla:hilla-maven-plugin (>=0.0.0, <=1.4.1) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=23.0.0, <=23.6.9)

com.vaadin:flow-maven-plugin MAVEN version =23.0.0, =23.0.0, =0.0.0, =1.4.1 Source cves: CVE-2026-7860 Source advisory: OSV:GHSA-J8MX-J73W-9MXW...

com.vaadin:vaadin-maven-plugin (>=23.0.0, <=23.6.9), dev.hilla:hilla-maven-plugin (>=0.0.0, <=1.4.1) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=23.0.0, <=23.6.9)

com.vaadin:flow-maven-plugin MAVEN version =23.0.0, =23.0.0, =0.0.0, =1.4.1 Source cves: CVE-2026-7860 Source advisory: GHSA-J8MX-J73W-9MXW...

com.vaadin:vaadin-maven-plugin (>=23.0.0, <=23.6.9), dev.hilla:hilla-maven-plugin (>=0.0.0, <=1.4.1) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=23.0.0, <=23.6.9)

com.vaadin:flow-maven-plugin MAVEN version =23.0.0, =23.0.0, =0.0.0, =1.4.1 Source cves: CVE-2026-7860 Source advisory: SNYK:JAVA-COMVAADIN-17176893...

com.vaadin:hilla-maven-plugin (>=25.1.0-beta1, <=25.1.3), com.vaadin:vaadin-maven-plugin (>=25.1.0-beta1, <=25.1.4) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=25.1.0-beta1, <=25.1.4)

com.vaadin:flow-maven-plugin MAVEN version =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.4 Source cves: CVE-2026-7860 Source advisory: SNYK:JAVA-COMVAADIN-17176893...

com.vaadin:hilla-maven-plugin (>=25.1.0, <=25.1.3), com.vaadin:vaadin-maven-plugin (>=25.1.0, <=25.1.4) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=25.1.0, <=25.1.4)

com.vaadin:flow-maven-plugin MAVEN version =25.1.0, =25.1.0, =25.1.0, =25.1.4 Source cves: CVE-2026-7860 Source advisory: OSV:GHSA-J8MX-J73W-9MXW...

com.vaadin:hilla-maven-plugin (>=24.10.0, <=24.10.3), com.vaadin:vaadin-maven-plugin (>=24.10.0, <=24.10.3) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=24.10.0, <=24.10.3)

com.vaadin:flow-maven-plugin MAVEN version =24.10.0, =24.10.0, =24.10.0, =24.10.3 Source cves: CVE-2026-7860 Source advisory: OSV:GHSA-J8MX-J73W-9MXW...

CVE-2026-7860

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

com.vaadin:hilla-maven-plugin (>=25.0.0, <=25.1.3), com.vaadin:vaadin-maven-plugin (>=25.0.0, <=25.1.4) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=25.0.0, <=25.1.4)

com.vaadin:flow-maven-plugin MAVEN version =25.0.0, =25.0.0, =25.0.0, =25.1.4 Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

com.vaadin:vaadin-maven-plugin (>=23.0.0, <=23.6.9), dev.hilla:hilla-maven-plugin (>=0.0.0, <=1.4.1) potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=23.0.0, <=23.6.9)

com.vaadin:flow-maven-plugin MAVEN version =23.0.0, =23.0.0, =0.0.0, =1.4.1 Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

com.vaadin:hilla-maven-plugin (>=24.4.0, <=24.10.3), com.vaadin:vaadin-maven-plugin (>=24.0.0, <=24.10.3) +1 more potentially affected by CVE-2026-7860 via com.vaadin:flow-maven-plugin (>=24.0.0, <=24.10.3)

com.vaadin:flow-maven-plugin MAVEN version =24.0.0, =24.4.0, =24.0.0, =2.0.0, =24.1.15 Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

CVE-2026-7860 Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

PT-2026-46866

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

PT-2026-41882

Name of the Vulnerable Software and Affected Versions Vaadin Maven plugin versions 23.0.0 through 23.6.9 Vaadin Maven plugin versions 24.0.0 through 24.9.16 Vaadin Maven plugin versions 24.10.0 through 24.10.3 Vaadin Maven plugin versions 25.0.0 through 25.0.10 Vaadin Maven plugin versions 25.1.0...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2023-34396 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2023-34396 Source advisory: OSV:GHSA-4G42-GQRG-4633...