com.vaadin:vaadin vulnerabilities

CVEs whose affected-version data names the com.vaadin:vaadin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-9467Medium· 5.3

1y ago

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that …

▾ Sunlitvaadin · com.vaadin:vaadinEPSS 0.38%via NVD