2 CVEs
CVSS 5.3
Vaadin ZIP Extraction and Authentication Bypass
2026-03-10
CVE-2026-2742
MEDIUM
PATCH
Authentication bypass in Vaadin framework (14.0.0-14.14.0, 23.0.0-23.6.x, and other ranges). The web application framework fails to properly enforce authentication on certain routes.
5.3
CVSS
0.3%
EPSS
CVE-2026-2741
LOW
PATCH
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 versions up to 14.14.0 is affected by path traversal.
2.3
CVSS
0.1%
EPSS