{"action":"Upgrade com.vaadin:vaadin-server to 7.7.50 (7.x) or 8.30.0 (8.x) or later.","affected":[{"fixed":"7.7.50","introduced":"7.0.0"},{"fixed":"8.30.0","introduced":"8.0.0"}],"component":"com.vaadin:vaadin-server","cve_ids":["CVE-2025-15022"],"ecosystem":"Maven","epss":0.00332,"exploited":false,"fixed_versions":["7.7.50","8.30.0"],"ghsa_id":"GHSA-7wwv-79xw-rvvg","id":"tcs_01M5N8KC6QPZ216GJN022FJDW0","modified_at":"2026-09-10T03:50:33.190776453Z","published_at":"2026-01-05T09:30:19Z","references":["https://osv.dev/vulnerability/GHSA-7wwv-79xw-rvvg","https://nvd.nist.gov/vuln/detail/CVE-2025-15022","https://github.com/vaadin/flow-components/pull/8285","https://github.com/vaadin/flow-components/commit/71046aa3dd08be0907bd03140c33131b94f6e99c","https://github.com/vaadin/flow-components","https://vaadin.com/security/cve-2025-15022"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-7wwv-79xw-rvvg","url":"https://osv.dev/vulnerability/GHSA-7wwv-79xw-rvvg"}],"summary":"Vaadin vulnerable to Cross-site Scripting"}