{"action":"Upgrade com.vaadin:flow-plugins to 23.6.11 (23.6.x), 24.9.18 (24.9.x), 24.10.4 (24.10.x), 25.0.12 (25.0.x) or 25.1.5 (25.1.x) or later.","affected":[{"fixed":"23.6.11","introduced":"23.0.0"},{"fixed":"24.9.18","introduced":"24.0.0"},{"fixed":"24.10.4","introduced":"24.10.0"},{"fixed":"25.0.12","introduced":"25.0.0"},{"fixed":"25.1.5","introduced":"25.1.0"}],"component":"com.vaadin:flow-plugins","cve_ids":["CVE-2026-7860"],"ecosystem":"Maven","epss":0.00117,"exploited":false,"fixed_versions":["23.6.11","24.9.18","24.10.4","25.0.12","25.1.5"],"ghsa_id":"GHSA-j8mx-j73w-9mxw","id":"tcs_01M5N92E8JXTZVF0076TQQEY6P","modified_at":"2026-06-04T18:56:25.675977Z","published_at":"2026-05-19T12:31:42Z","references":["https://osv.dev/vulnerability/GHSA-j8mx-j73w-9mxw","https://nvd.nist.gov/vuln/detail/CVE-2026-7860","https://github.com/vaadin/flow/pull/24219","https://github.com/vaadin/flow","https://vaadin.com/security/cve-2026-7860"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-j8mx-j73w-9mxw","url":"https://osv.dev/vulnerability/GHSA-j8mx-j73w-9mxw"}],"summary":"Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability"}