PatchTheCVEvaadin vulnerabilities
Recent CVEs affecting vaadin products. 2 tracked.
vaadin has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-10. Highest priority: CVE-2026-2741 (score 36/100).
- CVE-2026-2742 MEDIUM 5.3 UPGRADE An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0
- CVE-2026-2741 MEDIUM 6.8 UPGRADE Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extrac
FAQ
How do I fix vaadin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vaadin being exploited right now?
None of the tracked vaadin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vaadin CVE should I patch first?
CVE-2026-2741 currently ranks highest (36/100): Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extrac.