Vaadin vulnerabilities
We track 3 vulnerabilities in Vaadin products across 6 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.
Latest Vaadin vulnerabilities
- 8.7 High severity
framework: Uncontrolled Resource Consumption
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the
- 8.4 High severity
vaadin: Improper Neutralization of Input During Web Page Generation
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vul
- 7.5 High severity
vaadin: Exposure of Sensitive Information to an Unauthorized Actor
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting