Search for packages
| purl | pkg:maven/com.vaadin/flow-server@5.0.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2fz6-rucr-xqax
Aliases: CVE-2021-31406 GHSA-p7jq-v8jp-j424 |
Information Exposure Through Discrepancy Non-constant-time comparison of CSRF tokens in endpoint request handler allows attacker to guess a security token for Fusion endpoints via timing attack. |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-hqrf-7nbq-9bdw
Aliases: CVE-2021-31404 GHSA-xwg3-qrcg-w9x6 |
Information Exposure Through Discrepancy A non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` allows attacker to guess a security token via timing attack. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-5nk4-urbw-suee | Path Traversal Improper URL validation in development mode handler in `com.vaadin:flow-server` allows attacker to request arbitrary files stored outside of intended frontend resources folder. |
CVE-2020-36321
GHSA-49r2-73m6-pp8f |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-04T20:50:04.608335+00:00 | GitLab Importer | Affected by | VCID-2fz6-rucr-xqax | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.vaadin/flow-server/CVE-2021-31406.yml | 38.6.0 |
| 2026-06-04T17:26:42.367832+00:00 | GithubOSV Importer | Fixing | VCID-5nk4-urbw-suee | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-49r2-73m6-pp8f/GHSA-49r2-73m6-pp8f.json | 38.6.0 |
| 2026-06-04T16:21:05.987132+00:00 | GitLab Importer | Affected by | VCID-hqrf-7nbq-9bdw | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.vaadin/flow-server/CVE-2021-31404.yml | 38.6.0 |