Flow-server

This hub aggregates every CVE we track for Flow-server, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 12 most recently published vulnerabilities affecting Flow-server.

• CVE-2023-25500Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential informati...3.5Jun 22, 2023
• CVE-2023-25499Possible information disclosure in non visible components5.7Jun 22, 2023
• CVE-2021-31412Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-195.3Jun 24, 2021
• CVE-2021-33604Reflected cross-site scripting in development mode handler in Vaadin 14, 15-192.5Jun 24, 2021
• CVE-2021-31411Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-196.3May 5, 2021
• CVE-2021-31407Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 198.6Apr 23, 2021
• CVE-2021-31406Timing side channel vulnerability in endpoint request handler in Vaadin 15-194.0Apr 23, 2021
• CVE-2021-31404Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-184.0Apr 23, 2021
• CVE-2020-36319Potential sensitive data exposure in applications using Vaadin 153.1Apr 23, 2021
• CVE-2020-36321Directory traversal in development mode handler in Vaadin 14 and 15-175.9Apr 23, 2021
• CVE-2019-25027Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-136.1Apr 23, 2021
• CVE-2018-25007Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 112.6Apr 23, 2021