How many vaadin framework CVEs are in CISA KEV?

None of vaadin framework's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of vaadin framework are affected?

15 distinct vaadin framework versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in vaadin framework CVEs?

vaadin framework's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-20 (Improper Input Validation), CWE-208 (Observable Timing Discrepancy), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).

What is the average severity of vaadin framework CVEs?

The average CVSS base score across vaadin framework's scored CVEs is 5.6.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

vaadin

7 CVEs

vaadin framework Vulnerabilities

Name: vaadin framework vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for framework by vaadin.

7

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

5.6

Avg CVSS

2021–2026

Last updated January 5, 2026

Overview

vaadin framework has 7 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 5.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting vaadin framework, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of vaadin framework's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High2

Medium5

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of vaadin framework's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No vaadin framework CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every vaadin framework version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

7.0.0 <= v <= 7.7.471 CVE
7.0.0 <= v <= 7.7.491 CVE
7.4.0 <= v < 7.7.201 CVE
8.0.0 <= v <= 8.28.11 CVE
8.0.0 <= v <= 8.29.11 CVE

Fixed in

> 7.7.471 CVE
> 7.7.491 CVE
> 8.28.11 CVE
> 8.29.11 CVE
2e8b9d2b5b40652321aaa9d2bb2dba1041da7fc41 CVE
7.7.201 CVE
c30450f453165015d43e99ffe4a5fe57824a32021 CVE
c39400b55da214b2b6eb87260fb8f485a78a8aa11 CVE
d8ba0a4d10b7f7400b524252cd5925c58ce131a41 CVE
ebfc693f2d74965aebc6773ee696153441a822e51 CVE

Find a version

7 CVEs

Sort

Cross-site scripting in Action caption
CVE-2025-15022
Patch
Workaround
CWE-79
Medium · CVSS 4.8
EPSS 0.3% (25th pct)2026-01-05
Possibility to bypass file upload validation on the server-side
CVE-2025-9467
Patch
Workaround
CWE-20
Medium · CVSS 5.3
EPSS 0.4% (28th pct)2025-09-04
Medium vulnerability · 2021-10-13
CVE-2021-33609
Patch
CWE-400
Medium · CVSS 4.3
EPSS 0.9% (57th pct)2021-10-13
High vulnerability · 2021-05-05
CVE-2021-31409
Patch
CWE-400
High · CVSS 7.5
EPSS 1.7% (74th pct)2021-05-05
Medium vulnerability · 2021-04-23
CVE-2021-31403
Patch
CWE-208
Medium · CVSS 4.0
EPSS 0.3% (23th pct)2021-04-23
High vulnerability · 2021-04-23
CVE-2020-36320
Patch
CWE-400
High · CVSS 7.5
EPSS 2.0% (78th pct)2021-04-23
Stored cross-site scripting in Grid component in Vaadin 7 and 8
CVE-2019-25028
Patch
CWE-80
Medium · CVSS 6.1
EPSS 0.9% (57th pct)2021-04-23

Common weakness types

The CWE weakness categories most often found in vaadin framework CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many vaadin framework CVEs were published each year.

2021

5

2025

1

2026

1

Other vaadin products

Browse vulnerabilities for other products by vaadin.

vaadin27 CVEs flow17 CVEs flow-server11 CVEs com.vaadin:flow-server5 CVEs com.vaadin:vaadin5 CVEs flow-components5 CVEs vaadin-server5 CVEs com.vaadin:vaadin-server3 CVEs

All vaadin vulnerabilities

Frequently asked questions

Common questions about vaadin framework vulnerabilities.

How many CVEs does vaadin framework have?: vaadin framework has 7 published CVE records since 2021.
How many vaadin framework CVEs are in CISA KEV?: None of vaadin framework's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for vaadin framework vulnerabilities?: No vaadin framework CVEs currently have a tracked public exploit in this dataset.
Which versions of vaadin framework are affected?: 15 distinct vaadin framework versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in vaadin framework CVEs?: vaadin framework's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-20 (Improper Input Validation), CWE-208 (Observable Timing Discrepancy), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).
What is the average severity of vaadin framework CVEs?: The average CVSS base score across vaadin framework's scored CVEs is 5.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track vaadin framework vulnerabilities

Monitor new vaadin framework vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing