# com.vaadin:vaadin-bom (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/com-vaadin-vaadin-bom Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/com-vaadin-vaadin-bom.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in com.vaadin:vaadin-bom (Maven): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2021-33611, was published on 3 November 2021. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 18 (0 critical, 0 exploited in the wild) ## About com.vaadin:vaadin-bom (Maven) Vaadin framework bill of materials (BOM) for managing dependencies in web application development. ## Latest com.vaadin:vaadin-bom (Maven) vulnerabilities - [CVE-2021-33611: Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14](https://junglewise.ai/threats/cve-2021-33611-reflected-cross-site-scripting-in-vaadin-menu-bar-webjar) (low, CVSS 3.1, published 3 Nov 2021) - [Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8](https://junglewise.ai/threats/regular-expression-denial-of-service-redos-in-emailvalidator-class-in-be25bc3a) (low, CVSS 3.1, published 13 Oct 2021) - [Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20](https://junglewise.ai/threats/unauthorized-property-update-in-checkboxgroup-component-in-vaadin-12-14-0d145a2e) (low, CVSS 3.1, published 30 Aug 2021) - [CVE-2021-33604: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19](https://junglewise.ai/threats/cve-2021-33604-reflected-cross-site-scripting-in-development-mode-handler-in) (low, CVSS 3.1, published 28 Jun 2021) - [CVE-2021-31412: Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19](https://junglewise.ai/threats/cve-2021-31412-possible-route-enumeration-in-production-mode-via) (low, CVSS 3.1, published 28 Jun 2021) - [CVE-2021-31411: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19](https://junglewise.ai/threats/cve-2021-31411-insecure-temporary-directory-usage-in-frontend-build) (low, CVSS 3.1, published 6 May 2021) - [CVE-2021-31408: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19](https://junglewise.ai/threats/cve-2021-31408-server-session-is-not-invalidated-when-logout-helper-method-of) (low, CVSS 3.1, published 22 Apr 2021) - [CVE-2021-31403: Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8](https://junglewise.ai/threats/cve-2021-31403-timing-side-channel-vulnerability-in-uidl-request-handler-in) (low, CVSS 3.1, published 19 Apr 2021) - [CVE-2019-25028: Stored cross-site scripting in Grid component in Vaadin 7 and 8](https://junglewise.ai/threats/cve-2019-25028-stored-cross-site-scripting-in-grid-component-in-vaadin-7-and-8) (low, CVSS 3.1, published 19 Apr 2021) - [CVE-2020-36320: Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7](https://junglewise.ai/threats/cve-2020-36320-regular-expression-denial-of-service-redos-in-emailvalidator) (low, CVSS 3.1, published 19 Apr 2021) - [Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11](https://junglewise.ai/threats/unauthorized-client-side-property-update-in-uidl-request-handler-in-94d8fe7a) (low, CVSS 3.1, published 19 Apr 2021) - [Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13](https://junglewise.ai/threats/reflected-cross-site-scripting-in-default-routenotfounderror-view-in-9d18390e) (low, CVSS 3.1, published 19 Apr 2021) - [Potential sensitive data exposure in applications using Vaadin 15](https://junglewise.ai/threats/potential-sensitive-data-exposure-in-applications-using-vaadin-15-8804315d) (low, CVSS 3.1, published 19 Apr 2021) - [Directory traversal in development mode handler in Vaadin 14 and 15-17](https://junglewise.ai/threats/directory-traversal-in-development-mode-handler-in-vaadin-14-and-15-17-616bfa4a) (low, CVSS 3.1, published 19 Apr 2021) - [Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18](https://junglewise.ai/threats/timing-side-channel-vulnerability-in-uidl-request-handler-in-vaadin-10-160ae002) (low, CVSS 3.1, published 19 Apr 2021) - [CVE-2021-31405: Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17](https://junglewise.ai/threats/cve-2021-31405-regular-expression-denial-of-service-redos-in-emailfield) (low, CVSS 3.1, published 19 Apr 2021) - [Timing side channel vulnerability in endpoint request handler in Vaadin 15-19](https://junglewise.ai/threats/timing-side-channel-vulnerability-in-endpoint-request-handler-in-vaadin-62d29f29) (low, CVSS 3.1, published 19 Apr 2021) - [Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19](https://junglewise.ai/threats/server-classes-and-resources-exposure-in-osgi-applications-using-vaadin-3f9a7148) (low, CVSS 3.1, published 19 Apr 2021) ## Most severe com.vaadin:vaadin-bom (Maven) vulnerabilities - [CVE-2020-36320: Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7](https://junglewise.ai/threats/cve-2020-36320-regular-expression-denial-of-service-redos-in-emailvalidator) (low, CVSS 3.1, published 19 Apr 2021) - [CVE-2021-31412: Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19](https://junglewise.ai/threats/cve-2021-31412-possible-route-enumeration-in-production-mode-via) (low, CVSS 3.1, published 28 Jun 2021) - [CVE-2021-31405: Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17](https://junglewise.ai/threats/cve-2021-31405-regular-expression-denial-of-service-redos-in-emailfield) (low, CVSS 3.1, published 19 Apr 2021) - [CVE-2021-33611: Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14](https://junglewise.ai/threats/cve-2021-33611-reflected-cross-site-scripting-in-vaadin-menu-bar-webjar) (low, CVSS 3.1, published 3 Nov 2021) - [CVE-2019-25028: Stored cross-site scripting in Grid component in Vaadin 7 and 8](https://junglewise.ai/threats/cve-2019-25028-stored-cross-site-scripting-in-grid-component-in-vaadin-7-and-8) (low, CVSS 3.1, published 19 Apr 2021) - [CVE-2021-31408: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19](https://junglewise.ai/threats/cve-2021-31408-server-session-is-not-invalidated-when-logout-helper-method-of) (low, CVSS 3.1, published 22 Apr 2021) - [CVE-2021-31403: Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8](https://junglewise.ai/threats/cve-2021-31403-timing-side-channel-vulnerability-in-uidl-request-handler-in) (low, CVSS 3.1, published 19 Apr 2021) - [CVE-2021-33604: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19](https://junglewise.ai/threats/cve-2021-33604-reflected-cross-site-scripting-in-development-mode-handler-in) (low, CVSS 3.1, published 28 Jun 2021) - [CVE-2021-31411: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19](https://junglewise.ai/threats/cve-2021-31411-insecure-temporary-directory-usage-in-frontend-build) (low, CVSS 3.1, published 6 May 2021) - [Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8](https://junglewise.ai/threats/regular-expression-denial-of-service-redos-in-emailvalidator-class-in-be25bc3a) (low, CVSS 3.1, published 13 Oct 2021) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "com.vaadin:vaadin-bom (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/com-vaadin-vaadin-bom, 9 November 2026.