CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737

The push endpoint in Vaadin applications using server push is vulnerable to a cross-origin request forgery (CSRF) style attack. Because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false, the CorsInterceptor echoes the request's Origin into the Access-Control-All...

CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

EUVD-2026-110721

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

PT-2026-126330

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP ACCESS CONTROL ALLOW ORIGIN HEADER set to false and its CorsInterceptor then echoes...

Push endpoint returns permissive CORS headers

The push endpoint of a Vaadin application using server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, so a malicious site can make a cross origin request to it on behalf of a signed in user and read the response. This vulnerability ha...

No version of Vaadin uses PHP

No version of Vaadin uses PHP. No Vaadin product contains PHP code, and no PHP interpreter takes part in building, running or deploying a Vaadin application. Vaadin is therefore not affected by CVE-2026-109618 or CVE-2026-109619, and no Vaadin release is needed in response to them.This page exist...

Vaadin and the October 2026 Node.js security releases

A deployed Vaadin application does not run Node.js, so it is not exposed to the vulnerabilities fixed in the Node.js security releases of 21 October 2026. Vaadin uses Node.js only to build the frontend and to run development mode, which means the exposure, where there is any, is in build and...

@vaadin/react-components-pro (25.3.0), @vaadin/vaadin (25.3.0) potentially affected by CVE-2026-107588 via @vaadin/charts (25.3.0)

@vaadin/charts NPM version 25.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on @vaadin/charts and may be impacted: - @vaadin/react-components-pro 25.3.0 - @vaadin/vaadin 25.3.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691...

@vaadin/react-components-pro (>=24.5.0, <=24.7.12), @vaadin/vaadin (>=24.5.0, <=24.8.0-alpha1) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.5.0, <=24.7.12)

@vaadin/charts NPM version =24.5.0, =24.5.0, =24.5.0, =24.8.0-alpha1 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=25.0.0, <=25.2.13), @vaadin/vaadin (>=25.0.0, <=25.3.0-alpha3) potentially affected by CVE-2026-107588 via @vaadin/charts (>=25.0.0, <=25.2.13)

@vaadin/charts NPM version =25.0.0, =25.0.0, =25.0.0, =25.3.0-alpha3 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=24.10.0, <=24.10.6), @vaadin/vaadin (>=24.10.0, <=24.10.10) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.10.0, <=24.10.6)

@vaadin/charts NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.10 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=24.8.0, <=24.9.18), @vaadin/vaadin (>=24.8.0-rc2, <=24.10.0-alpha1) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.8.0, <=24.9.18)

@vaadin/charts NPM version =24.8.0, =24.8.0, =24.8.0-rc2, =24.10.0-alpha1 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

com.github.mcollovati:hilla-shaded-deps (>=24.4.0-beta1, <=24.4.2), com.github.mcollovati:quarkus-hilla (>=24.4.0-beta1, <=24.4.2) +10 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.0.0, <=24.4.23)

com.vaadin:vaadin MAVEN version =24.0.0, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.0.0, =24.0.0, =24.4.23 - io.sunshower.aire-test:aire-test-spring 1.0.11.final - io.sunshower.aire-test:aire-test-vaadin 1.0.11.final -...

com.vaadin:vaadin (>=24.8.0, <=24.9.22), com.vaadin:vaadin-charts-flow-svg-generator (>=24.8.0, <=24.9.22) +8 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.8.0, <=24.9.22)

com.vaadin:vaadin-charts-flow MAVEN version =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =9.4.4, =9.4.4, =9.4.4, =9.4.4, =9.5.8 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691578...

com.vaadin:vaadin-jandex (>=24.10.0, <=24.10.10), com.vaadin:vaadin-platform-javadoc (>=24.10.0, <=24.10.10) +5 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.10.0, <=24.10.10)

com.vaadin:vaadin MAVEN version =24.10.0, =24.10.0, =24.10.0, =9.6.1, =9.6.1, =9.6.1, =9.6.1, =9.6.3 - io.github.adumeige.vaadin-reactflow:vaadin-reactflow-component 1.0.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.vaadin:vaadin-jandex (>=24.8.0, <=24.9.22), com.vaadin:vaadin-platform-javadoc (>=24.8.0, <=24.9.22) +4 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.8.0, <=24.9.22)

com.vaadin:vaadin MAVEN version =24.8.0, =24.8.0, =24.8.0, =9.4.4, =9.4.4, =9.4.4, =9.4.4, =9.5.8 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.github.mcollovati:hilla-shaded-deps (>=24.4.0-beta1, <=24.4.2), com.github.mcollovati:quarkus-hilla (>=24.4.0-beta1, <=24.4.2) +14 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.0.0, <=24.4.22)

com.vaadin:vaadin-charts-flow MAVEN version =24.0.0, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.4.22 - io.sunshower.aire-test:aire-test-spring 1.0.11.final -...