{"action":"Upgrade com.vaadin:flow-gradle-plugin to 24.9.18 (24.9.x), 24.10.4 (24.10.x), 25.0.12 (25.0.x) or 25.1.5 (25.1.x) or later.","affected":[{"fixed":"24.9.18","introduced":"24.0.0"},{"fixed":"24.10.4","introduced":"24.10.0"},{"fixed":"25.0.12","introduced":"25.0.0"},{"fixed":"25.1.5","introduced":"25.1.0"}],"component":"com.vaadin:flow-gradle-plugin","cve_ids":["CVE-2026-7860"],"ecosystem":"Maven","epss":0.00117,"exploited":false,"fixed_versions":["24.9.18","24.10.4","25.0.12","25.1.5"],"ghsa_id":"GHSA-j8mx-j73w-9mxw","id":"tcs_01M5N92EH3EGNFXGT0BW9MJ44Z","modified_at":"2026-06-04T18:56:25.675977Z","published_at":"2026-05-19T12:31:42Z","references":["https://osv.dev/vulnerability/GHSA-j8mx-j73w-9mxw","https://nvd.nist.gov/vuln/detail/CVE-2026-7860","https://github.com/vaadin/flow/pull/24219","https://github.com/vaadin/flow","https://vaadin.com/security/cve-2026-7860"],"severity":{"label":"low","score":1.6},"sources":[{"source":"osv","source_id":"GHSA-j8mx-j73w-9mxw#Maven/com.vaadin:flow-gradle-plugin","url":"https://osv.dev/vulnerability/GHSA-j8mx-j73w-9mxw"},{"source":"nvd","source_id":"CVE-2026-7860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7860"}],"summary":"Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability"}