Facts
- Severity
- Low
- Affected versions (com.vaadin:vaadin)
- >= 14.14.0, < 14.14.8As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 14.14.8
- Affected versions (com.vaadin:vaadin)
- >= 23.6.0, < 23.6.17As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 23.6.17
- Affected versions (com.vaadin:vaadin)
- >= 24.4.0, < 24.4.26As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 24.4.26
- Affected versions (com.vaadin:vaadin)
- >= 24.5.0, <= 24.5.15As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- not stated
- Affected versions (com.vaadin:vaadin)
- >= 24.6.0, <= 24.6.13As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- not stated
- Affected versions (com.vaadin:vaadin)
- >= 24.7.0, < 24.7.17As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 24.7.17
- Affected versions (com.vaadin:vaadin)
- >= 24.8.0, <= 24.8.17As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- not stated
- Affected versions (com.vaadin:vaadin)
- >= 24.9.0, < 24.9.24As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 24.9.24
- Affected versions (com.vaadin:vaadin)
- >= 24.10.0, < 24.10.12As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 24.10.12
- Affected versions (com.vaadin:vaadin)
- >= 25.0.0, <= 25.0.13As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- not stated
- Affected versions (com.vaadin:vaadin)
- >= 25.1.0, <= 25.1.13As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- not stated
- Affected versions (com.vaadin:vaadin)
- >= 25.2.0, < 25.2.11As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 25.2.11
- Affected versions (com.vaadin:vaadin)
- >= 25.3.0, < 25.3.3As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin)
- 25.3.3
- Affected versions (com.vaadin:vaadin-core)
- >= 14.14.0, < 14.14.8As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 14.14.8
- Affected versions (com.vaadin:vaadin-core)
- >= 23.6.0, < 23.6.17As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 23.6.17
- Affected versions (com.vaadin:vaadin-core)
- >= 24.4.0, < 24.4.26As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 24.4.26
- Affected versions (com.vaadin:vaadin-core)
- >= 24.5.0, <= 24.5.15As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- not stated
- Affected versions (com.vaadin:vaadin-core)
- >= 24.6.0, <= 24.6.13As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- not stated
- Affected versions (com.vaadin:vaadin-core)
- >= 24.7.0, < 24.7.17As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 24.7.17
- Affected versions (com.vaadin:vaadin-core)
- >= 24.8.0, <= 24.8.17As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- not stated
- Affected versions (com.vaadin:vaadin-core)
- >= 24.9.0, < 24.9.24As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 24.9.24
- Affected versions (com.vaadin:vaadin-core)
- >= 24.10.0, < 24.10.12As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 24.10.12
- Affected versions (com.vaadin:vaadin-core)
- >= 25.0.0, <= 25.0.13As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- not stated
- Affected versions (com.vaadin:vaadin-core)
- >= 25.1.0, <= 25.1.13As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- not stated
- Affected versions (com.vaadin:vaadin-core)
- >= 25.2.0, < 25.2.11As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 25.2.11
- Affected versions (com.vaadin:vaadin-core)
- >= 25.3.0, < 25.3.3As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-core)
- 25.3.3
- Affected versions (com.vaadin:flow-server)
- >= 2.13.0, < 2.13.8As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 2.13.8
- Affected versions (com.vaadin:flow-server)
- >= 23.6.0, < 23.6.16As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 23.6.16
- Affected versions (com.vaadin:flow-server)
- >= 24.4.0, < 24.4.19As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 24.4.19
- Affected versions (com.vaadin:flow-server)
- >= 24.5.0, <= 24.5.17As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- not stated
- Affected versions (com.vaadin:flow-server)
- >= 24.6.0, <= 24.6.14As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- not stated
- Affected versions (com.vaadin:flow-server)
- >= 24.7.0, < 24.7.16As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 24.7.16
- Affected versions (com.vaadin:flow-server)
- >= 24.8.0, <= 24.8.16As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- not stated
- Affected versions (com.vaadin:flow-server)
- >= 24.9.0, < 24.9.29As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 24.9.29
- Affected versions (com.vaadin:flow-server)
- >= 24.10.0, < 24.10.15As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 24.10.15
- Affected versions (com.vaadin:flow-server)
- >= 25.0.0, <= 25.0.15As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- not stated
- Affected versions (com.vaadin:flow-server)
- >= 25.1.0, < 25.1.19As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 25.1.19
- Affected versions (com.vaadin:flow-server)
- >= 25.2.0, < 25.2.13As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 25.2.13
- Affected versions (com.vaadin:flow-server)
- >= 25.3.0, < 25.3.4As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:flow-server)
- 25.3.4
- Affected versions (com.vaadin:vaadin-server)
- >= 7.1.0, < 7.7.55As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-server)
- 7.7.55
- Affected versions (com.vaadin:vaadin-server)
- >= 8.0.0, < 8.32.2As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-server)
- 8.32.2
- Affected versions (com.vaadin:vaadin-server-mpr-jakarta)
- >= 7.7.36, < 7.7.55As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-server-mpr-jakarta)
- 7.7.55
- Affected versions (com.vaadin:vaadin-server-mpr-jakarta)
- >= 8.18.0, < 8.32.2As entered by the maintainer. Not reviewed.
- Fixed in (com.vaadin:vaadin-server-mpr-jakarta)
- 8.32.2
- CVE
- CVE-2026-110737 · published
- GitHub Advisory Database
- Not reviewed
- OSV.dev
- Not present
- Other CVEs pointing here
- None found in the CVE List
If you use com.vaadin:vaadin >= 14.14.0, < 14.14.8
Upgrade to 14.14.8 or later. Dependabot, npm audit and OSV-Scanner won’t flag this yet.
Timeline
2026-10-27 10:28 UTC
Published by the maintainers
Cites CVE-2026-110737
2026-10-28 09:43 UTC
First seen by Limbowatch
not reviewed · not in OSV
Waiting
Reviewed by GitHub
Waiting
In OSV; scanners can see it
Machine-readable record: feed/GHSA-gw7g-m6j7-48mw.json