CVE-2026-107588: vaadin 22.0.0 to before 23.6.16, 24.0.0 to before 24.4.24, 24.5.0 to before 24.7.16, 24.8.0 to before 24.9.23, 24.10.0…

Affected technology

vaadin · 22.0.0 to before 23.6.16, 24.0.0 to before 24.4.24, 24.5.0 to before 24.7.16, 24.8.0 to before 24.9.23, 24.10.0 to before 24.10.11, 25.0.0 through 25.0.13, 25.1.0 through 25.1.13, 25.2.0 to before 25.2.10, 25.3.0 to before 25.3.1
vaadin

vaadin-charts-flow · 22.0.0 to before 23.6.16, 24.0.0 to before 24.4.24, 24.5.0 to before 24.7.15, 24.8.0 to before 24.9.23, 24.10.0 to before 24.10.11, 25.0.0 through 25.0.13, 25.1.0 through 25.1.13, 25.2.0 to before 25.2.10, 25.3.0 to before 25.3.1
vaadin

vaadin-charts-flow-svg-generator · 21.0.0 to before 23.6.16, 24.0.0 to before 24.4.24, 24.5.0 to before 24.7.15, 24.8.0 to before 24.9.23, 24.10.0 to before 24.10.11, 25.0.0 through 25.0.13, 25.1.0 through 25.1.13, 25.2.0 to before 25.2.10, 25.3.0 to before 25.3.1
vaadin

@vaadin/charts · 22.0.0 to before 23.6.7, 24.0.0 to before 24.4.19, 24.5.0 to before 24.7.13, 24.8.0 to before 24.9.19, 24.10.0 to before 24.10.7, 25.0.0 through 25.0.13, 25.1.0 through 25.1.14, 25.2.0 to before 25.2.14, 25.3.0 to before 25.3.1
vaadin

Description’s affected range: version of it

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Active user interaction

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 8.4/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.