How many vaadin vaadin-server CVEs are in CISA KEV?

None of vaadin vaadin-server's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of vaadin vaadin-server are affected?

5 distinct vaadin vaadin-server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in vaadin vaadin-server CVEs?

vaadin vaadin-server's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-20 (Improper Input Validation), CWE-208 (Observable Timing Discrepancy), CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)).

What is the average severity of vaadin vaadin-server CVEs?

The average CVSS base score across vaadin vaadin-server's scored CVEs is 5.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

vaadin

5 CVEs

vaadin vaadin-server Vulnerabilities

Name: vaadin vaadin-server vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for vaadin-server by vaadin.

5

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

5.4

Avg CVSS

2021–2025

Last updated September 4, 2025

Overview

vaadin vaadin-server has 5 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 5.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting vaadin vaadin-server, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of vaadin vaadin-server's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High1

Medium4

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of vaadin vaadin-server's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No vaadin vaadin-server CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every vaadin vaadin-server version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

>= 8.0.03 CVEs
>= 7.0.02 CVEs
<= 8.14.01 CVE
>= 7.4.01 CVE

Fixed in

> 8.14.01 CVE

Find a version

5 CVEs

Sort

Possibility to bypass file upload validation on the server-side
CVE-2025-9467
Patch
Workaround
CWE-20
Medium · CVSS 5.3
EPSS 0.4% (28th pct)2025-09-04
Medium vulnerability · 2021-10-13
CVE-2021-33609
Patch
CWE-400
Medium · CVSS 4.3
EPSS 0.9% (57th pct)2021-10-13
Medium vulnerability · 2021-04-23
CVE-2021-31403
Patch
CWE-208
Medium · CVSS 4.0
EPSS 0.3% (23th pct)2021-04-23
High vulnerability · 2021-04-23
CVE-2020-36320
Patch
CWE-400
High · CVSS 7.5
EPSS 2.0% (78th pct)2021-04-23
Stored cross-site scripting in Grid component in Vaadin 7 and 8
CVE-2019-25028
Patch
CWE-80
Medium · CVSS 6.1
EPSS 0.9% (57th pct)2021-04-23

Common weakness types

The CWE weakness categories most often found in vaadin vaadin-server CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many vaadin vaadin-server CVEs were published each year.

2021

4

2025

1

Other vaadin products

Browse vulnerabilities for other products by vaadin.

vaadin27 CVEs flow17 CVEs flow-server11 CVEs framework7 CVEs com.vaadin:flow-server5 CVEs com.vaadin:vaadin5 CVEs flow-components5 CVEs com.vaadin:vaadin-server3 CVEs

All vaadin vulnerabilities

Frequently asked questions

Common questions about vaadin vaadin-server vulnerabilities.

How many CVEs does vaadin vaadin-server have?: vaadin vaadin-server has 5 published CVE records since 2021.
How many vaadin vaadin-server CVEs are in CISA KEV?: None of vaadin vaadin-server's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for vaadin vaadin-server vulnerabilities?: No vaadin vaadin-server CVEs currently have a tracked public exploit in this dataset.
Which versions of vaadin vaadin-server are affected?: 5 distinct vaadin vaadin-server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in vaadin vaadin-server CVEs?: vaadin vaadin-server's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-20 (Improper Input Validation), CWE-208 (Observable Timing Discrepancy), CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)).
What is the average severity of vaadin vaadin-server CVEs?: The average CVSS base score across vaadin vaadin-server's scored CVEs is 5.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track vaadin vaadin-server vulnerabilities

Monitor new vaadin vaadin-server vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing