CVE-2026-110803

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-107588

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are...

CVE-2026-110803

The Vaadin Framework 8 (specifically com.vaadin:vaadin-server versions 8.16.0 - 8.32.1 and com.vaadin:vaadin-server-mpr-jakarta versions 8.18.0 - 8.32.1 ) is vulnerable to a session lock leak leading to a Denial of Service (DoS) . The root cause is in VaadinService.requestEnd(), where the applica...

CVE-2026-107588

The Vaadin Charts library (specifically the bundled Highcharts library) is vulnerable to multiple issues including Prototype Pollution and Cross-Site Scripting (XSS) . The root cause is that Vaadin pins specific Highcharts versions (9.2.2 for Vaadin 22-24; 12.2.0 for Vaadin 25), preventing indepe...

com.vaadin:vaadin (>=25.2.0-beta1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.0-beta1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.0-beta1, =25.2.0-beta1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.7.0, <=24.9.21) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.9.21)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.9.21 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=25.0.0-beta1, <=25.1.11) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.0.0-beta1, <=25.1.11)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.0.0-beta1, =25.0.0-beta1, =25.1.11 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.10.0-beta1, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0-beta1, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0-beta1, =24.10.0-beta1, =24.10.9 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in SpreadsheetHandlerImpl.updateCellComment, which writes the supplied text to the target cell without checking whether the active sheet is protected or the cell locked, unlike the edit, cut, and paste handlers i...

CVE-2026-91860

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

CVE-2026-93547

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

com.vaadin:vaadin (>=24.7.0, <=24.9.21) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.9.21)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.9.21 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

com.vaadin:vaadin (>=24.10.0, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=25.0.0, <=25.1.11) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.0.0, <=25.1.11)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.0.0, =25.0.0, =25.1.11 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

EUVD-2026-89952

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

com.vaadin:vaadin (>=25.2.1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.1, =25.2.1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...