maven package report

Is com.vaadin:flow-server safe?

13 known vulnerabilities, worst severity HIGH.

cvss

8.6

how bad it is if exploited, out of 10

epss

2.4%

chance of exploitation in the next 30 days

xyz score

3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-25xc-jwfq-39jw, the advisory selected below

// advisories

GHSA-25xc-jwfq-39jw

HIGHCVE-2021-31407

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

Affected: >= 1.2.0, <= 2.4.7, = 6.0.0
Fixed in: 2.4.8
Weakness: CWE-402
Published: 2021-04-19
Source: github

GHSA NVD MITRE reference reference reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 03:32 UTC. The most recent advisory here was published 2026-03-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is com.vaadin:flow-server safe? maven package security report | CyberXYZ