com.flowingcode.vaadin.addons:error-window-vaadin (>=3.7.0, <=4.0.0), com.vaadin:flow (2.8.7) +92 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.8.7)

com.vaadin:flow-server MAVEN version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.flowingcode.vaadin.addons:error-window-vaadin =3.7.0, =4.0.0 - com.vaadin:flow 2.8.7 - com.vaadin:flow-client...

com.dorkbox.gradlevaadin:com.dorkbox.gradlevaadin.gradle.plugin (>=14.9.4a1, <=14.10.1), com.dorkbox:gradlevaadin (>=14.9.4a1, <=14.10.1) +93 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.9.2)

com.vaadin:flow-server MAVEN version 2.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.dorkbox.gradlevaadin:com.dorkbox.gradlevaadin.gradle.plugin =14.9.4a1, =14.9.4a1, =14.10.1 - com.vaadin:flow...

com.vaadin:com.vaadin.gradle.plugin (0.14.10.4), com.vaadin:flow (2.9.5) +95 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.9.5)

com.vaadin:flow-server MAVEN version 2.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin 0.14.10.4 - com.vaadin:flow 2.9.5 - com.vaadin:flow-client 2.9.5 -...

com.flowingcode.vaadin.test:testbench-rpc (>=1.4.0, <=1.5.0), com.vaadin:appsec-kit-starter (2.0.1) +96 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.10.5)

com.vaadin:flow-server MAVEN version 2.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.flowingcode.vaadin.test:testbench-rpc =1.4.0, =14.11.11, =14.11.13 and more Source cves: CVE-2026-2742 Source...

com.vaadin:flow (2.13.4), com.vaadin:flow-client (2.13.4) +91 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.13.4)

com.vaadin:flow-server MAVEN version 2.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 2.13.4 - com.vaadin:flow-client 2.13.4 - com.vaadin:flow-component-demo-helpers 2.13.4 -...

com.github.mcollovati.vertx:vaadin-flow-sockjs (>=18.0.0, <=18.1.2), com.github.mcollovati.vertx:vertx-vaadin-flow (>=18.0.0, <=18.1.2) +95 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (5.0.2)

com.vaadin:flow-server MAVEN version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs =18.0.0, =18.0.0, =18.0.2, =18.0.2, =18.0.5 and more Source cves:...

com.alibaba.rsocket:alibaba-broker-server (1.0.1), com.vaadin:flow (6.0.3) +91 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (6.0.3)

com.vaadin:flow-server MAVEN version 6.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.alibaba.rsocket:alibaba-broker-server 1.0.1 - com.vaadin:flow 6.0.3 - com.vaadin:flow-client 6.0.3 -...

com.github.mcollovati.vertx:vaadin-flow-sockjs (20.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (20.0.0) +99 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (7.0.2)

com.vaadin:flow-server MAVEN version 7.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs 20.0.0 - com.github.mcollovati.vertx:vertx-vaadin-flow 20.0.0 -...

com.github.mcollovati.vertx:vaadin-flow-sockjs (>=14.1.2, <=14.1.3), com.github.mcollovati.vertx:vertx-vaadin-flow (>=14.1.2, <=14.1.3) +21 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.1.7)

com.vaadin:flow-server MAVEN version 2.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs =14.1.2, =14.1.2, =14.1.22, =14.1.24 and more Source cves:...

com.github.mcollovati.vertx:vaadin-flow-sockjs (21.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (21.0.0) +101 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (8.0.0)

com.vaadin:flow-server MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs 21.0.0 - com.github.mcollovati.vertx:vertx-vaadin-flow 21.0.0 -...

com.github.mvysny.karibudsl:karibu-dsl-v10 (>=0.5.2, <=0.5.3), com.holon-platform.vaadin:documentation-vaadin-flow (>=5.2.0-rc1, <=5.2.1) +33 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (1.2.3)

com.vaadin:flow-server MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mvysny.karibudsl:karibu-dsl-v10 =0.5.2, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1,...

com.flowingcode.vaadin.addons.demo:commons-demo (3.8.0), com.vaadin:flow (2.9.4) +94 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.9.4)

com.vaadin:flow-server MAVEN version 2.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.flowingcode.vaadin.addons.demo:commons-demo 3.8.0 - com.vaadin:flow 2.9.4 - com.vaadin:flow-client 2.9.4 -...

com.alibaba.rsocket:alibaba-broker-server (1.0.0.m1), com.github.mdre:bubbledialog (>=1.0.2, <=1.0.4.1) +28 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.1.6)

com.vaadin:flow-server MAVEN version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.alibaba.rsocket:alibaba-broker-server 1.0.0.m1 - com.github.mdre:bubbledialog =1.0.2, =1.0.2, =1.0.3, =0.0.3,...

com.oliveryasuna.vaadin:flow-commons-parent (1), com.oliveryasuna.vaadin:fluent-flow-parent (1) +109 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.6.7)

com.vaadin:flow-server MAVEN version 2.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.oliveryasuna.vaadin:flow-commons-parent 1 - com.oliveryasuna.vaadin:fluent-flow-parent 1 -...

com.github.mcollovati:hilla-jandex (>=25.0.0-alpha1, <=25.0.0-beta1), com.github.mcollovati:hilla-react-jandex (>=25.0.0-alpha1, <=25.0.0-beta1) +165 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (>=25.0.0-beta1, <=25.0.1)

com.vaadin:flow-server MAVEN version =25.0.0-beta1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =1.0.0, =25.0.0-beta1, =25.0.0-beta1, =4.0.0-beta1, =7.0.0-beta1, =25.0.0-beta1, =25.0.0 and more...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to inconsistent path pattern matching of reserved framework paths. An attacker can create unauthorized sessions and trigger framework initialization by accessing the /VAADIN endpoint without a trailing slash,...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vaadin-flow-sockjs (>=23.1.0, <=23.4.1) +276 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (>=23.0.0, <=23.6.7)

com.vaadin:flow-server MAVEN version =23.0.0, =1.1.3, =23.1.0, =23.1.0, =23.4.0-alpha1, =23.4.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2026-2742 Source advisory:...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.1, <=1.1.4), com.beirtipol:jfixtools-reporting (1.0-beta) +289 more potentially affected by CVE-2026-2741 via com.vaadin:flow-server (>=3.0.0, <=23.6.7)

com.vaadin:flow-server MAVEN version =3.0.0, =1.0.1, =1.1.6, =15.0.0, =15.0.0, =23.4.0-alpha1, =23.4.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.1 and more Source cves: CVE-2026-2741 Source advisory: SNYK:JAVA-COMVAADIN-15518323...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.dorkbox.gradlevaadin:com.dorkbox.gradlevaadin.gradle.plugin (>=0.1, <=14.10.1) +283 more potentially affected by CVE-2026-2741 via com.vaadin:flow-server (>=2.0.0, <=2.13.0)

com.vaadin:flow-server MAVEN version =2.0.0, =1.0.0.m1, =0.1, =14.8, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2026-2741 Source advisory: MEND:CVE-2026-2741...

com.github.mcollovati:quarkus-hilla-commons-deployment (25.0.0-beta1), com.github.mcollovati:quarkus-hilla-deployment (25.0.0-beta1) +21 more potentially affected by CVE-2026-2741 via com.vaadin:flow-build-tools (>=25.0.0-rc1, <=25.0.2)

com.vaadin:flow-build-tools MAVEN version =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =4.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.1 and more Source cves: CVE-2026-2741 Source advisory: SNYK:JAVA-COMVAADIN-155183...