CVE-2021-31410: Vaadin Designer

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request.

Affected products

• Vaadin Designer: from 4.3.0, before 4.6.4 (fixed in 4.6.4)

Published 2021-04-23. Last modified 2026-06-17.