CVE-2026-91860
- Source
- https://cve.org/CVERecord?id=CVE-2026-91860
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91860.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-91860
- Published
- 2026-09-30T13:13:05Z
- Modified
- 2026-10-02T08:13:41Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
- Details
-
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.0.0 - 23.6.13 Vaadin 24.0.0 - 24.9.20 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6
Mitigation Upgrade to 23.6.14 Upgrade to 24.9.21 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7
npm packages npm package Vulnerable versions Fixed version @vaadin/charts 23.0.0 - 23.6.4 >=23.6.5 @vaadin/charts 24.0.0 - 24.9.17 >=24.9.18 @vaadin/charts 24.10.0 - 24.10.4 >=24.10.5 @vaadin/charts 25.0.0 - 25.1.11 >=25.1.12 @vaadin/charts 25.2.0 - 25.2.8 >=25.2.9 @vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18 @vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5 @vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12 @vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9
- Database specific
{ "cna_assigner": "Vaadin", "cwe_ids": [ "CWE-1321" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91860.json" }- References
-
- https://registry.npmjs.org
- https://repo.maven.apache.org/maven2
- https://vaadin.com/security/cve-2026-91860
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91860.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-91860
- https://github.com/vaadin/web-components/pull/12483
- https://github.com/vaadin/web-components/pull/12492
- https://github.com/vaadin/web-components/pull/12493
- https://github.com/vaadin/web-components/pull/12494
- https://github.com/vaadin/web-components/pull/12496
- https://github.com/vaadin/web-components/pull/12559
- https://github.com/vaadin/flow-components
- https://github.com/vaadin/platform
- https://github.com/vaadin/web-components
Affected packages
Git / github.com/vaadin/flow-components
Affected ranges
- Type
- GIT
- Repo
- https://github.com/vaadin/flow-components
- Events
-
IntroducedFixedFixedIntroducedFixedFixedIntroducedFixedFixedIntroducedFixedIntroducedFixedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "23.0.0" }, { "fixed": "23.6.14" }, { "fixed": "23.6.5" }, { "introduced": "24.0.0" }, { "fixed": "24.9.21" }, { "fixed": "24.9.18" }, { "introduced": "24.10.0" }, { "fixed": "24.10.10" }, { "fixed": "24.10.5" }, { "introduced": "25.0.0" }, { "fixed": "25.1.12" }, { "introduced": "25.2.0" }, { "fixed": "25.2.7" }, { "fixed": "25.2.9" }, { "introduced": "24.7.0" } ], "source": "AFFECTED_FIELD" }
Affected versions
23.*
23.0.0
23.1.0.alpha1
23.1.0.alpha2
23.1.0.alpha3
23.1.0.alpha4
23.1.0.beta1
23.2.0
23.2.0.alpha1
23.2.0.alpha2
23.2.0.alpha3
23.2.0.beta1
23.2.0.beta2
23.2.0.beta3
23.2.0.beta4
23.2.0.rc1
23.3.0
23.3.0.alpha1
23.3.0.alpha2
23.3.0.alpha3
23.3.0.beta1
23.3.0.beta2
23.3.0.rc1
23.3.1
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.2
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.4.0
23.4.0.alpha1
23.4.0.alpha2
23.4.0.beta1
23.5.0
23.5.0.alpha1
23.5.1
23.5.10
23.5.11
23.5.12
23.5.13
23.5.14
23.5.15
23.5.16
23.5.17
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.6.0
23.6.0.alpha1
23.6.1
23.6.10
23.6.11
23.6.12
23.6.13
23.6.2
23.6.3
23.6.4
23.6.5
23.6.6
23.6.7
23.6.8
23.6.9
24.*
24.0.0.alpha1
24.0.0.alpha10
24.0.0.alpha2
24.0.0.alpha3
24.0.0.alpha4
24.0.0.alpha5
24.0.0.alpha6
24.0.0.alpha7
24.0.0.alpha8
24.0.0.alpha9
24.0.0.beta1
24.1.0.alpha1
24.1.0.alpha2
24.1.0.alpha3
24.1.0.alpha4
24.1.0.alpha5
24.1.0.alpha6
24.1.0.beta1
24.10.0
24.10.1
24.10.2
24.10.3
24.10.4
24.10.5
24.10.6
24.10.7
24.10.8
24.10.9
24.2.0.alpha1
24.2.0.alpha10
24.2.0.alpha11
24.2.0.alpha2
24.2.0.alpha3
24.2.0.alpha4
24.2.0.alpha5
24.2.0.alpha6
24.2.0.alpha7
24.2.0.alpha8
24.2.0.alpha9
24.3.0
24.3.0.alpha1
24.3.0.alpha2
24.3.0.alpha3
24.3.0.alpha4
24.3.0.alpha5
24.3.0.alpha6
24.3.0.beta1
24.3.0.rc1
24.4.0.alpha1
24.4.0.alpha10
24.4.0.alpha11
24.4.0.alpha13
24.4.0.alpha14
24.4.0.alpha15
24.4.0.alpha16
24.4.0.alpha17
24.4.0.alpha18
24.4.0.alpha19
24.4.0.alpha2
24.4.0.alpha20
24.4.0.alpha21
24.4.0.alpha22
24.4.0.alpha23
24.4.0.alpha24
24.4.0.alpha25
24.4.0.alpha3
24.4.0.alpha4
24.4.0.alpha5
24.4.0.alpha6
24.4.0.alpha7
24.4.0.alpha8
24.4.0.alpha9
24.4.0.beta1
24.5.0.alpha1
24.5.0.alpha10
24.5.0.alpha11
24.5.0.alpha12
24.5.0.alpha13
24.5.0.alpha14
24.5.0.alpha15
24.5.0.alpha16
24.5.0.alpha17
24.5.0.alpha2
24.5.0.alpha3
24.5.0.alpha4
24.5.0.alpha5
24.5.0.alpha6
24.5.0.alpha7
24.5.0.alpha8
24.5.0.alpha9
24.5.0.beta1
24.5.0.beta2
24.5.0.beta3
24.5.0.beta4
24.5.0.beta5
24.5.0.beta6
24.5.0.rc1
24.6.0.alpha1
24.6.0.alpha2
24.6.0.alpha3
24.6.0.alpha4
24.6.0.beta1
24.6.0.beta2
24.6.0.beta3
24.7.0.alpha1
24.7.0.alpha10
24.7.0.alpha11
24.7.0.alpha12
24.7.0.alpha2
24.7.0.alpha3
24.7.0.alpha4
24.7.0.alpha5
24.7.0.alpha6
24.7.0.alpha7
24.7.0.alpha8
24.7.0.alpha9
24.7.0.beta1
24.8.0
24.8.0.alpha1
24.8.0.alpha2
24.8.0.alpha3
24.8.0.alpha4
24.8.0.alpha5
24.8.0.alpha6
24.8.0.alpha7
24.8.0.alpha8
24.8.0.beta1
24.8.0.beta2
24.8.0.beta3
24.8.0.rc1
24.8.0.rc2
24.9.0
24.9.0-alpha1
24.9.0-alpha2
24.9.0-alpha3
24.9.0-alpha4
24.9.0-alpha5
24.9.0-alpha6
24.9.0-alpha7
24.9.0-beta1
24.9.0-beta2
24.9.0-beta3
24.9.0-rc1
24.9.0-rc2
24.9.1
24.9.10
24.9.11
24.9.12
24.9.13
24.9.14
24.9.15
24.9.16
24.9.17
24.9.18
24.9.19
24.9.2
24.9.20
24.9.3
24.9.4
24.9.5
24.9.6
24.9.7
24.9.8
24.9.9
25.*
25.0.0-alpha1
25.0.0-alpha10
25.0.0-alpha11
25.0.0-alpha12
25.0.0-alpha13
25.0.0-alpha14
25.0.0-alpha2
25.0.0-alpha3
25.0.0-alpha4
25.0.0-alpha5
25.0.0-alpha6
25.0.0-alpha7
25.0.0-alpha8
25.0.0-alpha9
25.0.0-beta1
25.0.0-beta2
25.0.0-beta3
25.0.0-beta4
25.0.0-beta5
25.0.0-beta6
25.0.0-beta7
25.0.0-beta8
25.0.0-beta9
25.0.0-rc1
25.1.0
25.1.0-alpha1
25.1.0-alpha10
25.1.0-alpha11
25.1.0-alpha2
25.1.0-alpha3
25.1.0-alpha4
25.1.0-alpha5
25.1.0-alpha6
25.1.0-alpha7
25.1.0-alpha8
25.1.0-alpha9
25.1.0-beta1
25.1.0-beta2
25.1.0-beta3
25.1.0-rc1
25.1.0-rc2
25.1.1
25.1.10
25.1.11
25.1.2
25.1.3
25.1.4
25.1.5
25.1.6
25.1.7
25.1.8
25.1.9
25.2.0
25.2.1
25.2.2
25.2.3
25.2.4
25.2.5
25.2.6
25.2.7
25.2.8
Other
untagged-26dc4b35303a1c4b0165
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91860.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"150022249978387135335898648031466430231",
"47654431071345599032191180474923954650",
"11954607603114532691911732457153134501",
"117475445572161072163554277014343517892"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-00a42fcd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"139804014910014082595759955460233770290",
"157644513574755650845569825419532975039",
"13232134451527595369833234952243738595",
"336566875528174846137098077993175895057",
"43994750812215959662748770726165405120",
"85708241196083166070456182395835209029",
"224919112073548207090173162186740444094",
"327773519430404555652577262843872459845",
"55565235568084177155465310458437786532"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-01190b12",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165820063253606028607994999780872241174",
"142801850801475462271840188867743544867",
"313984569223613716081770794911704271602",
"327682701952160244489994657170830885082"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-01fa484e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80022704968395983671319834368854528852",
"329578008055425389530341520384079984482",
"206203954687464450569954600977164912444",
"97853516349101397292329081633705475928",
"192723554122292508452562176713328239738"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0727b513",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71460354054508795671266948633541700891",
"212559859979822323143054233100810662537",
"198783545751491051215205552533867115655",
"23325114055774291952210179534014219362",
"88348512905416377191899307033639078227",
"34922562359570007190932062577357010174"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0817dccd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextArea.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"43510491227183790451322630924295846261",
"275312833198246850961003269078561136624",
"67295578828912037526655496466693582571",
"184082853300383203704105311043223456386"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0941bbb3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"253406546756162198368367828773427419822",
"57695028920575890088265048630996569216",
"278030889699741896323279545368927911872",
"103504452930855624879232182794578427522",
"296243977377967769575063308015454401832",
"259082456681319694428215104373556283358"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0b11e718",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"338423057476371269078346580068761667516",
"165218624906225168839534597767385959035",
"89250510285310133884588160103397322033",
"136811365316337125176810354206658066049"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0b5ce31a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"181998991391930795137156905174572364027",
"313452702496745268026669533025368447274",
"273308196773801244355946784790390957871",
"273326547663240052817239981460802696126",
"244659612520530119270112738510282029586"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0c1b3b35",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"118158153763717151620121092253483548206",
"69279852248354485969350712832005945457",
"106220822277497594210889463452331274623",
"289798225587666472520324068090394052637"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0e4d3142",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/AbstractIcon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"161677153603347922741052097420041462680",
"36218417875482553913582419300779387570",
"61696775185337241996735601161199588227",
"246957671553949190126326930106307137813"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-0f6c99d7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/DecimalRangeSlider.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"337639349341496073403452413997753134055",
"182136995672750404607740388441871829705",
"197183611667140176443676879901914426301",
"64841229518222474182086907596992935989"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-10109631",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/GeneratedVaadinSplitLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"84580926978750649462666856580505288525",
"20950155072846833874090302653123654984",
"47323013180422026042497872102957335062",
"317917217584327708549344911359963129598"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-10da3114",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"182664332374397241867560437953609303411",
"284417103751131937565776830301772708372",
"219168464341844705548978465947213811780",
"40759398084498905414866955988205674767",
"115095400695661194487277946195219592839",
"53098429022801449403586801694792039795"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1107b13a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/Upload.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59835666500063819348493083385682773742",
"316862432427283741132636427359468679092",
"63234064922750047819109499817100995315",
"28697633963664451753992133865727417616",
"338845259220215469016309567234184766058",
"171072815716129496670032443756309909938"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-11a122d2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64045124586473418993041872196765760319",
"308804806241151468289307997172361938751",
"247198805478875923307778728005517095299",
"186734422492525047252513442279965703950"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-122bd724",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"167330863073057058851130656057846893984",
"246476471698108910922706156306352690968",
"212763058532742028530294085087274154624",
"80202939457722903529363759898306138971",
"272792247532658863933462844688520776911",
"177521574050509134662106393874813646090",
"154957769549024820487642560249913686243",
"238465965534242829011023792590122509950",
"9268348415452416658221667503415680913",
"130298711769705167609094959068571297594",
"13279292169896571158431860351375125138"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-123df95f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"151574430330520200132141933431172668062",
"31579161866500627277014733776285452892",
"220834342989198654823091587685915705944",
"77612431568419700513386035143835888058",
"37327474320808198522047499437812267435",
"125850619477790859631753415903401422193"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-12af8be5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"290792815840682295906563341758010920",
"82290490233510919299215528415099811812",
"95424981233633010694529324827624323394",
"54808891171187030445149481047751445387"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-134bf3df",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"11926996932901548406771578386876292593",
"219471549892987520333288078632757079546",
"218847027540348572831367480208694293592",
"161137083081090691540376690829134892574"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-13c71a50",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"339862003335662628973170513874122773771",
"65974874190256354269869374079200770034",
"43303751817703708085148604350091947621",
"77777718497245171770307129460114221876",
"129115829852268885374450744728054773216",
"236803956365960994462224245288448846588"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-147c05f5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"239525793681564293513698642042226958150",
"7651342984729899757691981719206070964",
"323798340691999263489291616077282080430",
"81184826637468337033831069936029790251"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-14a79e3b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/NumberField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"161677153603347922741052097420041462680",
"36218417875482553913582419300779387570",
"235959004905403814279835967529721117565",
"18912345717246113205765547770217184587"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-14df38e0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/IntegerRangeSlider.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"56528393212658678200357430461568690750",
"324075617448848753566477608573837291364",
"200843875323321980930896694717297892675",
"39308274493520037554703009470552368722",
"8775204585280572315364958627552987375",
"222839493919783777057687548430101822690",
"324368604219661060216728563426716179986"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-152cca55",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tab.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"217985803823550250262794179442048983042",
"29962460864819356945458102557563077090",
"80949025269625932955609311847156798092",
"316726975983332198531091345779308463265"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-16a92574",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNav.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288807544109764305603697632221890652535",
"87669936466187709514147407089959997451",
"176873081771583475227713670220193740817",
"283938057880133635805696002835834229712",
"155870715150561246077195289032981572172"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-16b4b062",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"261578446164430340313240255797147166599",
"191301381455674724605276141657358555491",
"162933372276523216620366521678832224057",
"279393638319446049418654063442491649035"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1719030a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNav.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"256823623620771854010867491336891532864",
"225964247291003487401912999995532053015",
"120428253622282011341788917383428609043",
"232898596033419302905279561903681822976"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1721dacf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"264886082386068594597620973772576322653",
"339552908121151548546411364592179598734",
"316468174699773892762939957988915546083",
"270347554342506327407917489379903211551",
"299873406723067243495889307874406772659",
"253071116440112744627798904430161236320",
"209316402439564089791189399690490103587"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-173a2bfe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinEmailField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"154483344855470361101684865004681358524",
"174103306002219151443859860370989806368",
"312457648539658348600017182369750410711",
"293212375484810887310512357454700064359",
"164616533515069105088821287476049377915",
"97904507079693366878464439040570795491"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-17581871",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/CheckboxGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318614899385403132639030391167910881223",
"169678073742986384507657576041428744923",
"269211986485941517985611465237138040929",
"56797995078007786366415582986982827879",
"157030477821597815681373676597042586221",
"134722098292300047869760730266290002417"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-17cfde08",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"162650051005338802484790117605269492564",
"253043602754952450580769775376977378134",
"35184461021558634366740274892738436889",
"339743292116345604460589772573233723959"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1804ef77",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"35264786871184202344822324839986302102",
"96431302827720461442343008439201716264",
"105717481411262094562281211651049672637",
"106301667041827920658490742295443036562"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-180aec42",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"65261207034701126607483489281406270662",
"14544999484550580017910451622633443926",
"331844193854727060947042346539745283940",
"253611163241845551610714254604715099783"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-18fa0bd8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"86793219918310560448036629292771366698",
"12138183376824227385729191507162399094",
"137828277845128724008431192982685073842",
"28534598826685830690112599163459512988"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-19b34f10",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNavItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"226718785279738169227864701510778095580",
"101124390178524459373447064230432030573",
"67873178327611045266091594984982033959",
"215616079332197731098993670623754149511"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-19e3fcc0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"79007600610408403369851045363049049629",
"337728120622393100832784758805682034557",
"300505273375851705722815066603747794590",
"66552036661751155077823502260530113463",
"199911446704891838224248183126227650258",
"5554345148795356092126872317329168629"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1bb8687d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/DatePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59636054818889035798626413970676301140",
"200197387999594121432300826620942343519",
"119272003430707712509225780878519567689",
"114951224209523306022245448321901229813",
"92849291564888292873221768494593741099",
"202248771337412680632312486228347915505",
"294713403702532653575331772384905182901",
"176015520490470973349035946791510781687"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1c83f63b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/Dashboard.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"143396411228304353806050147512067867775",
"263462391014071658266098368219621197022",
"170412936720389661037341764768176488158",
"136631493638403512968575615944578182434",
"160799116235950639922621058261226495421",
"130785252530047711336345947257209726016"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1cace1fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/PasswordField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"339849631427831223049978429670670751510",
"282319451311979212491530436234115681508",
"332748708974976255938609480860436128972",
"256535561965279729913366871614464593719",
"151090803441256613225818081668038784756",
"154473218616479039986315278420729779793"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1d26ee92",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/Notification.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"677117734493331432316145911839233197",
"160213264377640838067153238700837890490",
"328461641808303605742920323737810081743",
"284965866372647701917069165497983973834",
"188663203908123076233390873269441551587",
"309847126066467301921684163740419395755",
"258653698138359134022654877744521040729"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1d345d98",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"173937063169944159206362820498810695186",
"314256316346125263850957957481329931465",
"101831196918575528116593562589560141131",
"188337080513462347375032712572409917145",
"73099137799210703574303899403707165756",
"283311207175205736087148673442877418692"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1e1dfadf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314927501927776749997706372686884295090",
"130225475764449037356205531235331989557",
"144418911608124792523389788076103810052",
"224651553153346152351499138681149182559"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1f7040e6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"286095164987287837384579148483935314124",
"308825750001532296281596111732817448698",
"126195899400981515693710742725145711360",
"167635803900787829981391247485392848063"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-1fccb2c0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"52419679252482610457774442373676683118",
"165960436685952156218388484770446777996",
"265131620754932431503465102727009262891",
"168896713767143756737954853443544663314",
"129180324961494164483239205328175025047",
"240096638662798319750936881912569653680"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2000f372",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-card-flow-parent/vaadin-card-flow/src/main/java/com/vaadin/flow/component/card/Card.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"339358128199368660449303409421260137716",
"50859895656435089643606463987027579135",
"85200415459428684127076359124480213873",
"121086627409195035758333466384665493163",
"196459052972410184312324334850447117093",
"146569395576243949732748963256078066650",
"188656282883376723791402694916328283116"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-208e7a58",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"191808895912370347516695747938319400166",
"278464140399482312505247196505016597059",
"37831724787940896097335978412173181952",
"228042695521773983100669147966890801639",
"175791325826089812110533623204205660138",
"289634322657346398850163851324953878559",
"186806798073385807651842146375817809752"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2096dbf0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"176462570933424815658047137258311676296",
"11804231312275787404598469476240772286",
"237064518287325444808860864105251146283",
"12113835077192690950412275839293301343",
"227143884354788317902376880792080660055",
"331729605430946958981696168837120931667",
"68203389204870834201746409303363081660"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-20ec64d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/GeneratedVaadinDatePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230201620301265729287914823947106160922",
"289176930279900928222905526584305520651",
"171936610336888225332370714467666056963",
"317620444147960626850157651254516070947",
"255295401366700735586270104737784854054",
"35851375399594577352904787856160954472",
"339763955514387121919146246012918468799",
"288247635986409384575653099418480543391"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2142c154",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172105510792551928896217968902641556294",
"264574445747005778674097369856079708342",
"45588210604556331075443307514444178826",
"88174851034939858682824867459482268246"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-221e736a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"146426771534662590945852843454755018496",
"75879011513790196965782003493366789123",
"165594620557765425912316435700741975815",
"50591926597613146886408324650627911718"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-22604d2b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadFileList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"81337121501896101820178096669262208472",
"184205723005612453908572540374642500987",
"167435563806362947074955482526677220146",
"280008011580558847258969796448226520570"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-228d412a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadDropZone.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"187878492917358939303207349002436227632",
"65183619752008960595600515257969025756",
"175348754033651330298254900868356312679",
"217492588439935987009082552984441764973",
"122931687290364272819553630118007984411",
"5266620351163651567050367023060434760",
"114360412769718866045781607393166974270",
"232090047897335170397444635575195210234",
"240218483270638901428053521174419739162",
"245107801072664225405818235226806557965",
"90637910651623701523977683918065105063"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-22c795a2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319335563772636922441838168443882415880",
"191962149090652637672230472863835465396",
"273814512111863790569336450491072506349",
"210181994341964362488474114937120362408",
"311035585269293114669641902533751291582",
"239773814596530463941231860871776105213",
"129150706120547662184561353077942454000"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-22d5fc43",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"229575443713150187238803037046781648410",
"101518327093137825513180139229019078604",
"252361881394682108049271117757042496895",
"62733314001898924404383611412107441138"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-22eca243",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/Upload.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"191616509673216572170704538104501043884",
"218449799875624544054012009196360724131",
"38279662326071326784868277463498755088",
"169289265298972460231776069724763704857"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-237885fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314239849463081837626662116026871919866",
"40819544071635864086280156850796281894",
"47502861876602863699246286520016984129",
"277608954575247826530036581401651630528"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-23b34345",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/DecimalSlider.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"237182460022269225328930951631950830736",
"158394785713260049255126793858307372077",
"221712573213956385580447890331761467183",
"65187838607299131885624690654495379568"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-243d31aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"57576137265725683361030683898059436241",
"9784372319100683215754767622511098744",
"222370475748735533613936567000048990526",
"232195050182601260754401940854787409012",
"188821404639721968343183224743250648857",
"130881945820937367369054854758540490301",
"26847135543689638393775422567550366837",
"239494238228205856391532309480088524931"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-24ccc3c1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTab.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101277297818572325322835450913156032517",
"length": 344
},
"id": "CVE-2026-91860-25632885",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b",
"target": {
"file": "vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-testbench/src/main/java/com/vaadin/flow/component/spreadsheet/testbench/SpreadsheetElement.java",
"function": "isInSelection"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"68822094275835951492326558404713793457",
"328950934253056123061842809123157186838",
"190900229833919411130840504864411826266",
"216063143150106557101454488297107298842"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-26bd84f5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-card-flow-parent/vaadin-card-flow/src/main/java/com/vaadin/flow/component/card/Card.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"310723032833634798599800289931119409211",
"2099159557420148499595097462776673552",
"20513334240292002585711973050871101636",
"193806335394942766725414533603392981548"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-26e7e923",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319886305313204774108013156926536192936",
"150395070036305921884131467670221598048",
"102123083932101903230031242085604588729",
"163032960490188177649277847772543802850"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2876c428",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46676104213127268638121034995699486852",
"65872768018066367138274418837473568125",
"74516928638212288011875236089709824897",
"122966728784973760618833554131483100686"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-294d26fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"70064212409999567691996478128845481316",
"81429888010311549268959681702428914393",
"187170614660073231669853299150269403294",
"87973070905318547203268558341420762516",
"253702589209127932915004223952254647866",
"28211092190438673411206876980186956581"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-295cc498",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60363025378711219742842547724063607559",
"309584335845797394126197783036785504550",
"268634508645993679992845182965868937623",
"207418596094996944050788009803680683599",
"95696025324894524953214672662642746122",
"146364756731959192057897319229630616731"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2b6e07cc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/NumberField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59115855588606287649970956873056037071",
"59294973266345102400160149946518708927",
"230810576345641563209457256696384361801",
"58122651527967169145939033476219424770",
"65522036032228278526478053256044672099",
"20342091649349692267695053499351368229",
"249298486837261640137392691149500393968"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2bd1ef8c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tab.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"254411968841775354545790848483995001644",
"174924954776553532400443863312738025919",
"118478396708967026210987655857571948154",
"311858848155737421822668364988570375868",
"198530101220163538932302937904422130091",
"3534784715736654914339283796345001920"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2c28e12f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"163847944614342458294812051159848721823",
"340119597554805214031817451644806810853",
"135489395178113990714558129096458767502",
"145831029491862655494979760803292056635"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2c351c29",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"287240877486007018058517037253441486955",
"151432024311051203430075384205300972102",
"53877941281262083214868764019400575286",
"47589444521178565735032653989317397422",
"278835055807670583796575774117605933441",
"175435788758679859197709727631261733492"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2d7ce5a7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/NumberField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192329059073254750513606212101221384874",
"180943010683760263249829063912135678243",
"286144022943891506348121275733162456302",
"13725363218405470351618312454205006276",
"185215940862580526478630502726523784894",
"109968381096612378234786252127608400331",
"306905642126268387175527923967933992030"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2e425f8d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19496180787552983424536195175335494004",
"292382145854007549342876382309433698662",
"304955333998070277895377251333488285509",
"72247719429583895431012429309008218215"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2e8f027a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"283109948442922334697617923763787179641",
"328053159679619351604700774932371521981",
"224813297463884249916918688350377488118",
"297831502076321753290534872704633287417",
"139796755965455753218577141503206287082",
"136064380819477237718606767057061480890",
"336656691377228058967625245756260033136"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2ed9f001",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardWidget.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100682969109635639814209451039551377352",
"295034239930127197707877324101452447724",
"40337487413818703251372455430382612752",
"190910088224385431237697950746100904643",
"198095787651347432748322107290854612729",
"189963982058466762564955494724707293288"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2f2b1111",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/CheckboxGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"298089096182048118300085904107383029544",
"96388262575904299516900738297195738318",
"103082004713569729570821990027270337317",
"138758749581220245255680259923551835818",
"41193102632859346870643113944897855666",
"7084706873140500010492591379158392984",
"233622751301832335211639457853771697757",
"98697826311452383634708469123906294011"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-2fd1dc47",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"200538558900701543298409791978784231584",
"163861171940665120716729070945818019878",
"182089358515676914311824888440413348093",
"136392586581598612908418667656955429095"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-3078d474",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"120995776368842841540032495886723208636",
"97124622675518027156598655268177862697",
"283309843579607961405796279074403456388",
"196832386664497373049833293337314416129"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-30cda09c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13063391820631172953904965775403839668",
"179244571065038283731814233183086828444",
"223616494693066068673402814056766690650",
"273963831503250469257988592780068742123"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-324e8dd6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tabs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"332187042598988117410858011715268477876",
"115369977661683595734331105390833352556",
"216473666264351955095992393626449866086",
"185197387977402165661259126704707883396"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-325d45cf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/Checkbox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"191061560613689480253819919839691491464",
"28531836507086756392153710407978244161",
"309336307374985114853331499183041592049",
"269999713227844423592796109285805218844",
"96138524583551680182539677276971965015",
"250672098586985031667702795581154987902"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-342520fc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"115741627196033955352740076878494525557",
"12090350657536638073904665362396528545",
"101705517318127877902703184183789934088",
"152233282415911041010281959552727861777",
"193456814348297137911212479072491760205",
"109723050929774491613756726796354669932",
"33016324394107199248712789547205850548"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-34f3ae52",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"243866701728381313738622198332287023276",
"20874173117945042338402295576203325475",
"29411668627916835026796721339662665212",
"53949199179975319570456356017983057039",
"58763987950122613813479247974005461747",
"225263457551036152726080429596517156142"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-35eb9329",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"182411569621421995898137136551913566683",
"279946130114317484345431618292651097458",
"232976732317281311059132867437001706395",
"103511223650804043332532929290045263380",
"233831247336527785409047635101447028367"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-373e4303",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/ContextMenuBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155135688467525068229419652274037937906",
"78821348138547478635053021461037021442",
"232748733437646410317386577745908915264",
"189236337370126497418862688357303214379",
"172638711363753736835798950410457809067",
"236658381464253866091405925114434104886",
"194263834950269861011591660742891466368"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-383c06bb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardWidget.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"198278969368836027180516379064686156695",
"292475397102988434990519544339967114209",
"208201998159743364911190285311185476631",
"55754894210980901923760043823501980011"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-39d22c0e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319335563772636922441838168443882415880",
"191962149090652637672230472863835465396",
"273814512111863790569336450491072506349",
"68207926509279664122118898628473381260",
"187435772876896398444433897018940467589",
"177931250631534213142782163970362183460",
"29038517509170570206558330634759579926"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-3a740919",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"205886492405740034219645486187046810677",
"70678179978620260045708873833702871911",
"320891370851692573346756193065185250383",
"131505722228998972784114410275912231106"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-3a93fc80",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"148894924585365974642268941180823793989",
"205122796566615840020368803338149832688",
"4594601767935482560184412717222600337",
"51636861566931085158666783594938852877",
"252244327282403336485088762507028891446",
"31011048963010996575177804786949457232",
"3739999029154109081550460632421053991",
"293094725849694205411446862249340624511"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-3b35e291",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"44534781375291199580782136191885280440",
"4437261917412925391878554658654086777",
"95379092907407715683535410190963722300",
"154469792574197813733642830177856813398",
"221712455978723736614517743468350599982",
"232399090880183909592322498845881773151"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-3d3b2f89",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "94215097563696518968142770020851707059",
"length": 124
},
"id": "CVE-2026-91860-3dc25619",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java",
"function": "setEnabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"284956367072793838560863368648602872311",
"73926927601138603400947430286159346145",
"242886474003600155021846837875946191172",
"70779642465380805707942233979537287285"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-404e713e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"122214457292668270259616897966086856158",
"284868926174609364283242610964408704958",
"308579315570955473166196606396787837945",
"118863128363336726872649250392810598406",
"157713642203272456630450319704120225619",
"304954206707355744734948918909963245779",
"188628152124315505580886960743122661810",
"263562954493957973610699789735507356530",
"259532268690019241572784185038585407478",
"190616727812425483973702406763497022507",
"140960119378718788711635754128476173336"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-41805a19",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288697382611466629320255861159801026000",
"67843170617113520839887071821451292900",
"119707762601799422021209512523963706411",
"102211332704072232455406533706157437126"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-41d860e4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"298681038068353783669040037461577991024",
"159618791007228107099708471078428002177",
"43482409582076661932093587706154707690",
"36786430489340192100807310632607298905",
"112253298734384870366355456937041087955",
"339039503525011916525355240557573778233"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-42d3163d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125542708423254180184490501726435776211",
"285326487856755650705580980438075886426",
"252093910142031954120233202640959430170",
"145179201001583151611475073460071351655",
"71044882135712510871477415856482053537",
"95216166418836703016698099765570302407",
"199285825967559726837200400213781854275"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-454d38b6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/generated/GeneratedVaadinSelect.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184236262922026496279433832334031982977",
"131485253675872489743137859007724128444",
"201561132135111867427906619256639719084",
"186711090563500187815144970995606008851"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-4624fc68",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-badge-flow-parent/vaadin-badge-flow/src/main/java/com/vaadin/flow/component/badge/Badge.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"299623599809392475231361928544625637091",
"91776709457794079485987557824761172901",
"271907999530889196917982403954395966928",
"53502339423995883769046757254510866324",
"233156435622039246010919824063251107817",
"3302870043256233924606901775784721522"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-468c023d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-markdown-flow-parent/vaadin-markdown-flow/src/main/java/com/vaadin/flow/component/markdown/Markdown.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"109511982655797452939015622368148062683",
"74218516679440080281267252406700877123",
"267518687815487679580073047429859636243",
"92900267606857882623736677957867461971",
"102087353120615643410056730700579294959",
"234791744416850508024599488530706104395"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-46a542d3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"185106646767982335649997511782696897303",
"212432676798402569369029961837092795699",
"210700442976250407034921625521394528803",
"161986217768719924419948958414346551472"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-46cf4434",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/Dialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165968137833737408160637340064193260666",
"214569625351503208711812290184090583754",
"235949935109141752180416121379180788889",
"91103122562431492031006384456842969936",
"71309471997345684108042794883609122409",
"12315998428467556154894715146980870935",
"96165518297190150486800625269449151755"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-47c9b081",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"243003439425595897387104480557169101796",
"208628986090217831119968903738540548616",
"283330007312915906284973432693769825235",
"119222423561108384753123788269270559189"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-48488823",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNav.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "319212023653206220283449331138288993953",
"length": 238
},
"id": "CVE-2026-91860-4c07bf6e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b",
"target": {
"file": "vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-testbench/src/main/java/com/vaadin/flow/component/spreadsheet/testbench/SpreadsheetElement.java",
"function": "isElementSelected"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"87927471926570327586706129866231420985",
"83477091966492858221645024893733687094",
"213105690240447874751987789138699816256",
"187921168488348115088329591395103645781",
"152281197428669212135669824339057691531",
"87048077321762640088437254243245322978"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-4c2e4e14",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"29143086595964715638679839335964555436",
"197484545637239969173300077852872208166",
"12901518315434289807934191433575620395",
"256085568011290674787323188557374733153",
"166584884665947565823818159338178777040"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-4c325123",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155973625857343951946058963937001834685",
"244871676133739294956219770218191651923",
"317109608140074587140510011738615554866",
"402956137859420992496058199306435848"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-4cda4bf2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-markdown-flow-parent/vaadin-markdown-flow/src/main/java/com/vaadin/flow/component/markdown/Markdown.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15698723147241475930750619660506166978",
"128555961472113491233200122454670790249",
"115274807142504644087023868638950057113",
"277457619339576881844385343413258133001"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-501651f8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"161789032417775497927028249718519807782",
"295188965970819343385963683081255486952",
"42933334843854916521104866664477727922",
"3216241012338932786639023110765854070"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-50bd679f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"109099308319594873921528275837220308588",
"142429247337826247633249731870136759958",
"233775504849881222799801841540070473483",
"165119053358499097601623809758969847530",
"243196388267204202737234894496400276847",
"89764715898966822222390877389766815997",
"253855398323365199244936792947038376290",
"273556940925835595189723640177595251671",
"115660092913163023514208615922277110685",
"11494545405891050460251534424069639681",
"83058234698690279094721657936699160665",
"157307893810061268982960113253866788728",
"41321985310312895987871303574956775995",
"139743062104737638620488794851827925099",
"78486513658984066616140717383883970104"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-516a39f5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246015875481931204296256701349457317156",
"50338354493980513450613778932362888810",
"38542540292502266785821176074410612612",
"90536225681265423538999170556534362963",
"186652229361918700486804721640998271406",
"89819880862687467879411780731981765370"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-51a7436d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/EmailField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"300826378304734914384370620371318123410",
"109355843476382320286417959182311815101",
"239926748279198558638184990052482578327",
"29406460051694085704676060758007442464",
"152546706606826330494638609122572832129",
"163410448430256130578429428470909854319",
"193753302363044114337060192692555588050"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-52fb2146",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/GeneratedVaadinDialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"164533704348853400832432883263824287394",
"313044704061272424170010982026829011294",
"340221541720633508064832967694349373360",
"136679825650411954488784338502231391393",
"139373270610501959711048931176845048542",
"299528989631884498948650396462958369917"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-53ada6a5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"204712174750791791894296481926590824995",
"50650082256468644059968368052777405418",
"283175933641113180328350236492106948538",
"58936357330732602615564276908650797233",
"25442829955775751978485294846412194681",
"182627984277603122234718702030352921073"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-558d3ef9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"174935549487082484041772387425930210949",
"339901688476950347950191275428512624569",
"60667006300343880581537973784494375672",
"119046087782027317943977808691790815284",
"273050958374732210829831961661036284340",
"14735135444873947301021267859471378952"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-566caf34",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"69841822592022145402349033498556052472",
"51707144573319539687572802807417629373",
"130837768301543318238599309974784200431",
"203937132478992112885449817341150594414",
"216283572204349149770617163243943026529",
"236838918553408296822469601103971029127"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-56a204dd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/Dialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"115932272642902392566299230649185020274",
"317655542300988685903170852637608072995",
"43369646329958978481234205284491553443",
"339275876894944824040302103281663599302"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-56e10d35",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"120767614015157957116832806591258772871",
"159316906014981805017369374603790611300",
"272967845450666244248019911106028104115",
"263228877494902058929860530487322881280"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-573b2b53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"208737347097499460649065520147819483112",
"9887858371098162727385022718867313583",
"258868636927991030791569444309707069621",
"198853275657369263780851532599680526042"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-58776315",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"43168907721496937807060761376284438182",
"138322767020864317215767040828408154170",
"172799544826302982077084874429319562754",
"16750184594322163914510769486499090481",
"106505701127485929459122114668251633130",
"259992568681891345952287935380210032176"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-59600604",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"268424382519619221068243805225422369939",
"176329273338983782513885306095672287091",
"99835585631660131885254132199032615732",
"111072382864189789668459439661681623412"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5a743f90",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"33965752179760906139177103205278343571",
"310588763100592834827091584735291253494",
"303722193600591801922555595504036493472",
"88156380706443353533511243365776549762"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5b0425e1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardWidget.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"7509650228223745123955093846417153567",
"20208408537690051594190466668889934156",
"126906206841940722681101212418595494396",
"81376961339590630854549931066954948848"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5c06d9c8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"188163430304847106402419393621983642057",
"294813204071162874034937883330036858590",
"258127025353727746047976604287580900469",
"321387867364496169763838590176806469436"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5d165e43",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-popover-flow-parent/vaadin-popover-flow/src/main/java/com/vaadin/flow/component/popover/Popover.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"150519796866952524036360116552890432631",
"240802955889077688764171411284803721713",
"251646388857854122909459259245383089700",
"240816790028212216573871398389064158226"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5db6dc40",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16254789370448755722369943425960263760",
"128170299825627541635541604069992576056",
"293000082674174306409619477272413590966",
"334567268811864269333043601906117787501",
"10717530082562116733866717900185443796"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5e6e0738",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-master-detail-layout-flow-parent/vaadin-master-detail-layout-flow/src/main/java/com/vaadin/flow/component/masterdetaillayout/MasterDetailLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165842194142105340939541442835414348773",
"107098799373957471370496027361916408678",
"232970443216779284884442327201367234416",
"31523543339164020012623363243185001084"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5ea33b3e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"23915464060710696087093548938400709203",
"296891493060618395130466698131365893180",
"221679676065858660553951247086586331214",
"272240179496748985686775716627170322054",
"252757338102080358672145075646818532343",
"91569646472235957676549351189222665045",
"227048749957502766678637860274872565139"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5efba4f1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"325714592229502105765106057893056694461",
"211594831898298997645976958528284852959",
"291701945198085101043529254730676827278",
"52638596657975888205592312732195837540",
"84387726759769345885064278101183810675",
"237270723104887642642046240933220876935"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-5fa6fc25",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"86297538617788835848912872688789953321",
"64314744928844037843411451827423366288",
"214465647016627080201805856430274665252",
"192161380160773546493375836517642912665",
"285784964176737256010770708083049090472",
"93445143048318257609861494390362547947"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-606c319a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"195872166064038912416814011074557845593",
"102694864198822237186884711274208417250",
"40353231455315680183133332071630342457",
"143951135370435846800180020269358345920",
"86592538618473062846915078226153603780",
"94715695344542986648380569964858077615"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-61443d77",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"261194203071361036844171277682591862999",
"146632641186678873229818928951882222458",
"151231302634578861987264146848149730318",
"55782839602399776088425081751119704042",
"15033242662298267173051793511514859601",
"179977265774384916739625517829791410862"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-61d035eb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/ContextMenuBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"331695949661642704054358543676425196993",
"130082900393848411472914659772066510704",
"278654718638579125009443920264070020237",
"103105773234313912841403200130872626900",
"68680838279358822913179183397277559126",
"22794154688379504767843814072194529010",
"243375664151456322202188921250557969544"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-62f98fe3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"9492058904144190462401318803108478148",
"136441113118671111146403447684565221490",
"94410663057367313691000613485137356915",
"125430935359713052196588441594211849121",
"286623339757839513386709493927026550429",
"165049308801656684927896637794252904898"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6300d222",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/Notification.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"285299561337708045084141733360397181879",
"328712877877364299738110475660279280186",
"226765082156902828799671219370805527776",
"84228523039162689436281501616357021129"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-64196bb5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"133692119156590038724960648503878388387",
"128799939694515685140101245758848655362",
"66895408611146281818575319932888804466",
"297761285997344584033497421090789238355",
"91047348625361866104586324859834302900",
"222640208638284573934082880350817430565",
"231257574783938170895854250570117476448",
"193891923162156337782198482712842965396",
"231641059062251897602530987003028083978",
"198462424370723068282635268499212359372",
"213046146385460822868339206060287575225",
"22908424730610608225943025312239326876"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-64f780c7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"10695398993901130126524256648111426756",
"71088825340520715117035264342596952622",
"298121506233416827925719370144078121969",
"265902173811208154901801579954188507255",
"79950434984058930922753047753947397395",
"15525473410893240237817433022336524429",
"251051406288606960212531596126689067364",
"142566843632775685958365403892440461981"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-651c9911",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"272445947043007518687477305477329869479",
"60600229709230289423930932894937581193",
"223296469431784272874863123042383424449",
"210404082331664569157739307981984556001",
"8671091646369936396242548351860070249",
"140838976918662262142588828794062222888"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-658a6f18",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/Upload.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94932384613816633695496180149607502386",
"326259052865574321665797409733342735367",
"103354501524288949954432116897960412590",
"160834781040322187917445926517488801569"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-66466507",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"22608943814735554080260452743789021849",
"255672148858980605281042921763497852876",
"297307368075890483644630176272712766374",
"11992029449152443567309608112944314266",
"303845321096730943506688281587233179176",
"109383799550672341692102976450407950532",
"257160395088732415267496068560189532121"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-683a3c4d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"37954593981273224711651226117012275374",
"50029570256929089570759330400766271728",
"49509070851887386787907590323123065782",
"11992029449152443567309608112944314266",
"134392995199879721010538339736372947234",
"88623736752635021964856203766557704040",
"167635133703589878233420053367415801339"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-684fa8db",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288687792673433700348197131593301366820",
"227481294731255731117075951849040142366",
"171383274442616444605643400008098622313",
"110486892725720736657994911124852247826"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6bc60953",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"277528017817876802727725325136260185618",
"176840988565288406166336156846210233369",
"281584566184203670806375394481570243192",
"77454217334003516391490276321733626959"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6d129ed4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"241689171885620782826981589845663004777",
"299616126575864573876546891671612518081",
"54830249824303220446958746624092296859",
"263782993191051094061743760653308064638"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6daccd77",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"17212059509445286379964670667150793504",
"85717068869346576046281913497764085003",
"250320678773599102149281490072375231972",
"53158937159786167420633050912289859020"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6e8dbc9c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246495699286117784876940535996927167370",
"36322029582246090283878995999200189506",
"104781442316363996658754814161426595801",
"110598215805717078279779415929388554796",
"157713642203272456630450319704120225619",
"12134746024668202352507960293395126502",
"320058606233320720295253178081969585030",
"66457225638123345155072827834297469935",
"70878197866488802167937304949045691077",
"303025568116758076427192124058382137415"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6edecad5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"213009417188491791307043362245826794342",
"182753604209043474200604711505150072076",
"230907507161339091686735364828898540585",
"13692868300423321171914222465504622505"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6fce9ff4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"334233500371833792753575364112259844628",
"284153417450888717578420138615768288735",
"188485950816725313378128281625837796446",
"114402648547973463757447937287298547284"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-6ffc2a03",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/IronIcon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"294314443659328314574063781147987609033",
"184497596477210097044303804620817361300",
"91205654088421391358817480570349116215",
"24856242566569369743684399045216605687",
"218695919518928119345354988807493610693",
"298769898696448505585452584922567717363"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-703676cf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"143027530658372023088229755334480505379",
"277062982386753469501822314400029559958",
"7980661278346755451253668923627946156",
"97185659982981264166042609487890681675",
"290112551944260181188061900517467724853",
"163682424446931058655768675477507220723",
"269909026305062634715610484805272460580"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-706b7d72",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"234183088506690694303166601224076625433",
"225544410550713821855868466431949071835",
"50124943851605132355968008306493713230",
"277694019031374263398670218687918785815",
"37385236458568929460289125423005037820",
"265401350939266099739239063731935736903"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-711a8674",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"218862919199480754051629337260538835454",
"124951472782991165983569559182773423930",
"12404004292233203819400791899139090814",
"176168551134820289968728650782907125546"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-723e8ccb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165514547439980300028062992971534138879",
"197736796814260515462926292968769301795",
"28567907427771622444594021055117702644",
"121086627409195035758333466384665493163",
"100692717951015748919787003728740983249",
"208842102433802380174781413921072434269",
"106793714606155189369913400520341547072"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-72def470",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"9486403756278168829181911628021249626",
"104356880514060629591554550210751516088",
"133007495947680000070408269365694609962",
"12743654030765929263470535305973498692",
"139196424454802799599119657153757607969",
"327674210378814045462636197031106408964",
"256410201959885610488855575299852273346"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-73018cd9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"296134014643193894687108216620192861202",
"150076420155488188747186365406386646575",
"58308549095909287863561501069992775605",
"218467119670865233717677283628302079794",
"91605728170722333859935741182843980187",
"325101047337923583092387400877391856847",
"27185662108624818765404783584005661541"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-7679858d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293436043113931556661991005760028454662",
"235447229653449438895142897430340348379",
"82651066619456103634628477963619224361",
"116431308566440759502980775418169177020"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-79a883ee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"206620605891499776784643063226886948164",
"156030796842365566805121611889242939290",
"45925193147904737269478008098808241387",
"156420382374552099720260547299012607975"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-7a7f42ee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/LumoIcon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"143945263087195195433056481264397757373",
"270753459082211352046272627266038344264",
"190083653505490176739099851326740872486",
"114309851045378841944690168680536785152",
"225803020388371833297188319532595137627",
"1729832148544909964121999006213758779"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-7c066812",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"130020321119585648304602959223018937953",
"145419976555646725813793441848892554965",
"72305727064057742973202909915956970373",
"106866120391306443300106877633896973227"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-7c63b533",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"225540483090751340113889186684091680886",
"158690280929840228910283972184184972671",
"149489179055218984381384723167628830813",
"53104386335829487354348172393287393433",
"297746535931736199834954775694367018750",
"257895823319996181498803808031197966094"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-7cbc4402",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"242461987113815059436224261876920864994",
"58616288638414918022360298820018421596",
"286230058410876662914872230508195362817",
"314003210706103683491813105602213624942",
"195091782348218444133263496554676348800",
"310982269801446836170220224483744019876"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-7d6e51db",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"31037700099059140541680305419453522593",
"138937999678846696860540119192324993979",
"59750104353806682566840667148220941246",
"114166284125066660673694458256931888839"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-80153141",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192909844326342575930476358813383402930",
"190796852851426654903390631192665159694",
"86952591961967838159154087611792472747",
"221491069540331823576923451771662301382",
"134202564630436431769670348683638748810",
"267164055659843323265031284140235744459"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8102fa49",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100700901744817609794181689536149178239",
"288090506492172444876757703068805289052",
"8186000294009409977394771021970617247",
"84554294403884587699916380107453218325",
"266968653199521199028925839167009581104",
"52736570179951010502897544369355381305"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-813bc713",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-markdown-flow-parent/vaadin-markdown-flow/src/main/java/com/vaadin/flow/component/markdown/Markdown.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15316911802207747544311992172040113304",
"292004762124625875959443494704751598430",
"119477781839475121223157296765172606589",
"62689871670929169898403069475800120316",
"82859937631875715803374124147260715449",
"209395364945961899673180406834146151382"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-817d892e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextArea.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"289816378108832693747395344146423737229",
"261685897857072776751021786120559667931",
"313338299458204470094747796957812776056",
"324998533848178408765609434958929749402"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-82a4201a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"198647512187499685214880613042387758106",
"21032544857452856975558220738798765247",
"49319481243249676713773822152903144416",
"31222762952286725222602278372113198445",
"147513196678257908188434477544544196950",
"244001327660446836958714168002808457491",
"274840722312985869075649982803895211809",
"182892724988435501255759983926365202557",
"37474888515022502532728131506171977668",
"302227653316512308628960120001890913951",
"332515598916671325400434797384003480246",
"219315195384702890339653847086626519552",
"54956054180153818160320175187228292394",
"318983410520993044277614759720770880234",
"72944434445205206427676858270487019129",
"42614068511606013618242338875671513685",
"4838823625669271305504437570829113350",
"46879597844519904515200519902454487083"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-82dea924",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/FormLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"281041278146625037846237307998288270115",
"96455886673329772949554242428891453743",
"258806655506500355893160637960825588652",
"135850451773833390008276204144309570053",
"131860617791473901849924104194991484323",
"245565197176910799955030232569448555153"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-82e4edca",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"163780455284891476353348728803571808626",
"207003107923825393341936437263634722476",
"66571163961688925539899958841772730227",
"173090136893706246406790341047000659172",
"122003765385291644868845163016085538101",
"193193835907941882594806923652097626349"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-83788efc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"259616495201720087437866816274058275089",
"200521057745719612628443780901403271093",
"143313823054256977147879255128417027884",
"161844718935980922427007755228063449338",
"224414386535484235082722158657921806006",
"176661459619587272285881066189885915878"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8586fd7a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/AbstractIcon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"223040610374237325027818743355929955062",
"131066009192597574867696755545880438161",
"178597332604072057606393046724597848768",
"211201672180609774870195209014496340893"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-85c5169e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211718625142959083659010516062488358425",
"117401814046726618197775161750400511144",
"139256287925872931606031228103741393289",
"167438719336612057965373778498193864641",
"315768386472693748164478083606810582631",
"109060019357375908852124640024146588505"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-86324df6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64226170934336236073007597738702317760",
"207424279715551666644601135288349175006",
"191537745693800899161546529704068355154",
"289564311499018879947485301797170874731",
"66809657976619777237557298512259981855"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-890ee491",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170177601492972031142254973377685755055",
"336894393230552887673325076094538910172",
"115145836779381282673348070539918128011",
"282210364516564480941166080730746167345",
"66953115293861206819822956391122111361",
"28308467775159067066658526014428778146"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8aa895eb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"287186416013572949763105224739891442651",
"191502664875437273041369946956444100678",
"235862688173339796275065364958489457899",
"236089026525151820978041911618386317395",
"85483642999652078342297647274909358879",
"165227323230700831177659376166211368268"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8b3454aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"153207122623884445047797724091910247953",
"216721727960725661017942656554715374908",
"312981624680046901859656947543876699210",
"264742941078667782852372442425679836220",
"334248027950794975344092776906003767145",
"95860418630962260153239021042889717445",
"323971206125243789982296403605346610575",
"58646461031110749292119143500843335157",
"29680548340287104505120825337220360544",
"36289073821421993263491029901709151598",
"101772106490337782377827537402774476614",
"300418299418071681711479770714908312039"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8b88d8ab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/FormLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"17139459073066948577597065442463722733",
"238370078926877545422041364937098904025",
"242993266706821184277991774083634041766",
"332292535226721593041079559061372192472",
"29073209658698636902063524831228222573",
"7064186056011437102597373108829099942",
"271167879179362872872949303908286764581"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8d23ec31",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"138398861081424908706042942857777361439",
"161629079414440565853943164587761245716",
"124916498853164783907287825534199094782",
"22620731170674566011206681370407679497",
"157428713359604502028976071253887385691",
"327058251699920420489861089927165604404"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8e2b8aa5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"91436520539647052828691984743273971212",
"74552997467599200024952774955645858197",
"36762249312816587962413439503377249751",
"19183890552927045569564296378996439650",
"112594015300868323150873906028952801648"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8f5619df",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318169978420655560834861458604140627385",
"201241979948086642080975612603467551591",
"289006815259786259767173033557327588764",
"3035670795667065395203864972851072781",
"184716445595699671364714982228250106602"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-8fde8059",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"175667881125707828122800597656399472032",
"334387810294794106437670458081783172260",
"7737267507985098291491303243436102924",
"36748884427554299075344391692964274506"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9058fda9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"273897097380758717627673208757021885519",
"174426425397083941624352370773054077637",
"77702827145574704672186341406438646743",
"142658506569278602447085121911313067404",
"219398517610271030083955676145192695699",
"251963939413601368355105413574192039251"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-90852b71",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"72307871886703161904392714791892092136",
"333613575222032533820164106757021428046",
"312872950847669951778513129954280004091",
"293342212780890603916221441823755720758"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-90c5929f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172259922709106497992383723855710225242",
"49609173297035156188267319797237144803",
"78690953418027825220177646906206855161",
"273768175796495120200017321800539695933"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9204d2e1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/EmailField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"217994938692373097733105309720460880879",
"282112240875589196519345889556431577866",
"296006313870808539847500464380455576075",
"258997274089820588223636486033858545967",
"238057154839703584951216849813020209906",
"55618603362587405262756623814301413260"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-922d8e8a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13741248180689557946106214883381041063",
"40146802486074565853844147879313361774",
"26547252252825219293406564386550954959",
"163896346242739205592265607297146750106"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-92748c71",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"216300732090117562895032066190750471283",
"223623679212502705972237032710334370682",
"201290637399674135506191106937059524138",
"49076613771828789456059252802804881070",
"338617588737870113000959695241412883580"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9354579a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"286129081824461912373386685418830838504",
"122696600537683304201517824359619617954",
"331499159739763707425498094410591953275",
"93010352653554887474572428483108300692",
"296135578515743027946389472736410346002",
"335302875285392095343386765465369235547",
"263894116202172533101595019824822189903"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-937005e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"263932228569716878028493654794287555373",
"251520267803906853601443427278291596190",
"113351744021313239603160655734773573898",
"160416262712267843847167610626014510564"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-93f309b1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"122704781773245698545434446041619243388",
"209179017803964333571140612309255006566",
"256893496407683937477881851753446849552",
"259092040532679597299322434212137024503"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-95df022d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"151861268607778617528442703297741355291",
"62997444179922146649000533830357941312",
"41933201836200407367609330097471767646",
"172001675943777915675869389875081093441",
"289971105651836865924670331962781488329",
"194788201666869751516466351063789372735",
"186998710628045208448839329807664559585"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-96ceb930",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"53236655905047689743343450916041941390",
"70463800229370569566016426332751107025",
"250608411832073748968436975650380128306",
"226166445819169570206210976910032022997",
"157713642203272456630450319704120225619",
"261164977420066113379105787905435915524",
"232060819630126110476431811137009317002",
"216482500899341642344781408769874110138",
"141131548921904255321379476419982221532",
"302448473363790744640235977691059039680"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-97611026",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"248576065396190347144728238716615547204",
"33530504603780559933686951533678137431",
"253259934117684048742143639480466379077",
"85282335728970902773934333448224923924",
"319440907584164452038868100939594996087",
"203310192476709982220269851353250627798"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-98106e94",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"270064432359579580076235852296308999471",
"31297989078224108306026391392933587062",
"193640368209559062201530548907812445381",
"47349015229353814134605922319423142611",
"31780099556070361462176726419774538502",
"53467278015159944524510335949254227670"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-981b9b72",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"89455094992706848882219560453246704289",
"184773115111085186161434946742064021753",
"287702400723949005411831341744797501513",
"277238228141301508550489084180834536063",
"230104132238528120452058792616525685498",
"63206207566607191317657833327182934635"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-98a53473",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/EmailField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"188955872903654492216388914638133212854",
"96067614133234538814144289917933158223",
"15792975074872021262673902516588493961",
"212861641974843638425040798069764743113",
"48435976830759833605795897185317759421",
"25807009063683446370478853981472653538",
"255002618588899229101184740783834607058"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-995ab1d9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"73113795437636250337321382749251574859",
"268553614403655341714282016820784300808",
"14554019686349229226289952234911669586",
"216097515817509548636234799582274729824"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9ace89a0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardSection.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"294707649347153029405421350152206022372",
"289320593152719182708559373848438430250",
"182783921290473136252140625853475583224",
"166895127300125691071248134695360622117",
"230644445349521509569488243246452667592",
"158235741940916407700951219136474683682",
"119887395962312828079291059994691821828"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9aebe935",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"4252397771718907214816543802811780961",
"203682811904211726706773787491852329753",
"247806510149670943726691223433383638198",
"300829172236222065131946397185898768365",
"247998809037967485703080966689541699493",
"146805001640389271271665854943949018483"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9b7a3bba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"135163134023661399101076358198769646482",
"272817857918727019932458361006249733080",
"51976246831853328126255003473374627649",
"184165126111819592261379437563597541898",
"281277479688975817295120033539535409264",
"213004463680310334186615357280747041199",
"103183608564847399837648108642626145056"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9d25c8e2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardSection.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"82465081527692526402060435399892962443",
"159177851704651217439589715777182690789",
"277978493726565810510509977458218904244",
"191039007739664202817256575610768859567",
"294029928509718505220789978322275004333",
"112575547365222581705760579345821413408",
"201442886552379448809319985910642586798"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9dc980ae",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46935872803836794102752343038521704407",
"310213531760686522619586468958114768071",
"235384204806932755774827487713689588561",
"193424572134930982267340407536578474855",
"313213175944018409705065377228753848171",
"73967241968942362997205520195817440573"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9e49b2a9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/ContextMenuBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"269703463402619740055975131044029090305",
"165793450725239033137659362075864980668",
"316935609457901331552860792768068888271",
"284419610177847437230491598774949154247",
"288979666781226988292671552440469558702",
"87354922235235327783240364723539680819",
"70652922328652635804157113041361035290"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9e505fab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71298231999110877854977230871011746485",
"50033616505973103442599045217786086990",
"266761223182232786887719926953885551820",
"17309129211923649190311030856821621394"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-9f79c043",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"183661810790771756276600647785215593335",
"163953221421388512769752447468725541283",
"57044506158293758226761417118269150011",
"148539533779514203998298939821174617487"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a01e059f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3747459429878414448462577926462842449",
"218524146567427119372410935870638425896",
"143859476620716492677025939397642586699",
"193347563249656837090940636136910768252"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a02bb5fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUploadFile.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"292021646779122297545106900446304053758",
"50484194930506747024179951824785831322",
"296531537221491376102505939163439911343",
"185700480790560942677798551815932028265"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a05697e5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100839270956576169588477955253773809038",
"186314345834809138306556563359335897327",
"117640065616668742211183891099112536411",
"129259114258998560937028265648375942326"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a158547e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"35548971261736464652740290540666984209",
"284144111876692616287812896496231947206",
"124215852962832153935805549777140868581",
"58472845697157076654006756153538043935"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a178bc25",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-breadcrumbs-flow-parent/vaadin-breadcrumbs-flow/src/main/java/com/vaadin/flow/component/breadcrumbs/Breadcrumbs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"114410902717654010894233428950214619278",
"285672836741330026445817111281582336626",
"155771577510833144557253140924623695912",
"275543087307107646055022490908315450425",
"283284371600428530737359669766567409311",
"252379708843453306825306218868606876445"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a2708fd1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"21227522182542128695877441772043364054",
"280232788834897151624455764562425060218",
"326802776617848061725822318490912768969",
"124621194736784945557835360886083322751",
"176350313577864214163874374920187502319",
"107149033961027880252532211751204042686",
"151504935647717589128606775739355363416"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a406f317",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextArea.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"110884903166894414314094557662559942039",
"206630681242459063977873026595980177567",
"38500256514598055381437606712815889267",
"273309716519723668405782285685164996321",
"284309102270475709302381221947756978119",
"8916090830652495843285792880063796135",
"170452268445978674027321881128146511287"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a52931f4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"175821896079906491546495407448054900385",
"262052391982764164545261375368314616747",
"15795385505584747432708366944930097165",
"156503663235108745445757867469600065911",
"126768361933395370752796233859934781458",
"262238998175482893271011138426646907322"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a7372f30",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/TimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"140897548586509453255628883461954810508",
"330253662261774958689576399451810112421",
"61751914351754773331308455192880657983",
"269095706675813886136754853786467146252",
"75686606371502851043618542270166160766"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a7b3e490",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-popover-flow-parent/vaadin-popover-flow/src/main/java/com/vaadin/flow/component/popover/Popover.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158083999616970084865558401558314138505",
"301695222334958291631607068421150655048",
"128637682445616260261516030105850246680",
"331867424061267949356242511854035605008"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a7dbc33f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"331840309606413920329566731680531077261",
"325775648053078910998965466605552940276",
"188513189907641937520674316385079768433",
"303556764474508714310000007550364481805",
"98312673574687481808221658700288328207",
"325450817363175960243334315341871449741",
"128656164862467941083431583963133406895"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a7efa864",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"306569565186884312448394043083856876040",
"90913666099664839297555284851725856672",
"215703293011356304502512298546875971308",
"304953966273949263627944950483557190274",
"45613749521986617246012348557826422543",
"35685353617785912056710020076124779352"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a8a49ab9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/DatePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302266890798810844425583005350020712785",
"20653944505422516373720386232501031556",
"47268719125627302469474966406424366815",
"203545127554392161980370111385127632494"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-a9b8cb03",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/GeneratedVaadinProgressBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"329258424847658363934542711335871296912",
"246230322393379731114375459334178226493",
"268122333928359557283787905973128022238",
"103453545790890714471122148632630658795",
"267413017143827733860289377460737788883",
"184668056986977873622904075461446892962",
"287576625282471812304410175774539171795"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ac564f0e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tabs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"152465361100995071184113446553309529328",
"197735841289552272421653618005349438640",
"87599765616459415669821548397108045059",
"256903787323307877437183775589307346145"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-acd8f4ea",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-breadcrumbs-flow-parent/vaadin-breadcrumbs-flow/src/main/java/com/vaadin/flow/component/breadcrumbs/BreadcrumbsItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"35042164962131879423852798472665158984",
"334338804907630990117763142230653398557",
"152085211708504497443025724518187746021",
"313393773274946483677080789133281606609",
"34275494161687850458375209920254636276",
"41417433753614015572062946356799612718",
"84329100855289328211950208530206453166",
"85313434810737355423842705408109276654"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ad365234",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"198886245835771555799255607358840987212",
"131111832254518247591204311786984054682",
"18327617528390065991835634439128094637",
"57370576604096520726657801655081113562",
"31539705499914117702692357079283020607",
"81694484141645837258738186516998324097"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ad89e4fd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"198133348019911184215383447763754614775",
"180647126960723276888069377989246825336",
"48091453683052398371122987333688223881",
"116946763914749595870013187288970599853",
"15017311191612649133838898487718693642",
"185594591336112113564536720966860993858"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-adeab348",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15561949018290956864858030243628250254",
"98402311974612688047225984858482205445",
"206136158880437953131080087931352726743",
"268081317950629857808859215976786398718",
"304913328062575972807921735956352408873",
"94485591114044306308186028280510740967"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ae06fdb9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"290602405391722824758593884556281563324",
"45562812048430893566786838410913597554",
"95962027479079802825658536394088414982",
"74378206895964183901043479553977895861",
"302652901202117598265292436594201667966",
"246395884098897398283115628236714287501",
"68574240783192397774013611505769785725"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-afbb6094",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/GeneratedVaadinButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"157618035939260416624303900298176598989",
"301373085352754471481466939801004927416",
"209047635362721052828370708416842238722",
"57149809821657081314195817723156614097",
"17020392855735474254904159052154397284",
"276226431468771808046151862758969302532",
"44173318426708978767428596523017735001",
"75385984258550474494979230331427111655",
"44577620567949090085282011164139043283",
"291006460486519518492116388394468770274",
"192777481132803751958892886508463001286",
"188278385786347862102741975298703166764",
"132795863756969832695605223751728329676",
"190383862081031616478265877132169662280",
"299607987853524260189308996789227812560",
"137747352174428328055239541980395793306",
"337991211691687789478692762572733787919",
"20852170086004971186537977360973695699",
"321096966137212934089768556273678824177",
"331225987917223565639750072257625483771",
"33418372602960645112421985380394916565",
"43921841694542266475714577875484314694",
"101964898985507069036018755971491519274"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b071f503",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"264810375198202281052237583333885872748",
"120330610410566778273474244514535347597",
"126691195870628948406246533844756236586",
"59899086060179810590802816856019812605",
"160831976443012732529543374476821988804",
"219787878045153420824300055572897279452",
"308194455916845101429284089933925160619",
"247534912660287641774070804226394957948",
"191151246788996757670849488782924154784"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b08c1a0a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"127403949388793812751790920998532279342",
"171271229392313362031687611679415814400",
"274559978183589632573428361096790644816",
"262512437039626970798085267630357462772"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b0e12764",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"36014278876800646412415183710643565081",
"69805889774702802594681815102630197897",
"265337545633700122557546308763505064160",
"333730949719838316842232000309093880656",
"329683297791299968690113918906685090906",
"156478663263092608479511778792929503684",
"337269462531029046172730568955292921695"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b23545fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/GeneratedVaadinTimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"249026093832844837766830785197691709380",
"227912246111322214563542748846531056106",
"151336125913051794608279045107913018923",
"321317797643847083961534643390412351720",
"207249037672481594696392284328317296460",
"185433344719776604986282149734971586258",
"52444827414347959589929221579200508955",
"285084676521978198077518627414966803100"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b2751482",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTabs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"52765728604631931388722088860675118360",
"291987060413712714197744564977571985619",
"31101689248137221143283147649534093298",
"267706409067167793430134184604493580266",
"271936170832283257622679772524681051672",
"114952147493081416219437395782647828788"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b2945dc1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"147902836278351662522347094240809926783",
"114681597478210789109870131579337225527",
"249276930013983055015668982764002099197",
"88383475362077328659238010823989895062"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b2f1973f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/CheckboxGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"231387156178935617898739513793413437748",
"107871831655797976711792289272576776499",
"89273277111318696654785613474171316143",
"120743902296710881328578934742470336597",
"303022385357953223381049494538188268985",
"173922398149373533726088923941560267176"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b3523281",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/PasswordField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"29634425887807995656816279956715852550",
"148006298376392769693477096730577399975",
"336533176826674679168695306384563752982",
"301790761505480666990302368281790750130",
"295340421663442023057045762499203004175",
"242073429964776128390434430786425301890",
"66307494969066130369855367427108709878",
"58135636467803864970574641077021477216",
"284467156388718033929338434368438205976",
"208240229691672722908223414062994876441",
"208790956448946594046597343173051871255"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b54436c9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"271388821673869829407794230721962429974",
"232310694496046211525714199084194797690",
"216445786654131497352977782079791942166",
"107432573095909485568669394175618893033"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b57ee506",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/PasswordField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166991970097207763098882341709530345157",
"99643428964889711427624689777016277716",
"36002910287982724568136914702364550851",
"35735164940356661782080437227165139322",
"199250534797027582648617535250989794050",
"255367305213772629138460332344838658936",
"82095094985122493580687082607073149202"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b5a4073f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"173736766828775672733249859485797734776",
"324595626210917538095541670933011559361",
"252176140224135733305343346491111024571",
"273677490586445197100033188045981050701",
"112670577977649907233659613539289679451",
"279469753425258577116084372989087953827"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b5fece46",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149286409461437386191953540480133784087",
"49893343540222275457444686606027682991",
"249811514533215902220728379827826410075",
"91103122562431492031006384456842969936",
"121962156312976409413971193791180840985",
"73118177241664850946307267252691107143",
"174667181549613192901529913923084661747"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b64fc7a5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71687896583188192026300235114535837854",
"100041569795686277469178249930404779148",
"87713070843503317570493158264591969877",
"336198618098942297917097350091468782784",
"123981362139938307046053353726270195035",
"89274431546160161657995060864567856671"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b78bee00",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16737564262995772171574308722993530448",
"321044719298573500035259504410505310738",
"288899636742328523412543577990877804921",
"15212173775034213636395645419930287312",
"282523647538093995213764344493402038067",
"15443124746952533375991441029749541526",
"37014539976917280432164335953063216599"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-b8656437",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinPasswordField.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "65313709292149367055722205061676845717",
"length": 209
},
"id": "CVE-2026-91860-ba908aa9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java",
"function": "DisableOnClickController"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"274010816636142188604979890642516895603",
"256855816368385195845086429305827913901",
"87438981867710216480630608279074385043",
"108195188889407327178572201299944080550"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-baa6831b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"150419936935118648056025105239334948919",
"158721021022252648606455676746730628846",
"44822633323437605094242224521113144417",
"219349563143839809817798851199102487266",
"208977375263161438666244749448529948819",
"160129893080666484571235124464287796360"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-bb69fe53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/TimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"133649201688321882713428026178444800203",
"161460649361402428975023761658687440207",
"37471200067585969808876757234530854469",
"132151675085800208527943916776512595085",
"78599188599561770387804248239393072746",
"240484443808672308446145218953409535267",
"77976230274680133791950358573498791613"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-bbaf49db",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckbox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"176446288448669160668152096212791716267",
"51172496757670748577728675721687728396",
"161446562570766516118178200336455550423",
"119034231884320478917072653750616123420",
"258817706310009778471909247500372899447",
"133566092414396898935956466281634736992",
"37725719197134004075259347108066180024",
"292160898745200375474015252073470360127",
"147066646078768702799811365504531619510",
"297769594631884958055643511102716002151",
"162442997946872021388922595788181467267",
"383181013305790402247557322927332202",
"32404028509127235974663563457104100612",
"135137754573002149104388871522635813342",
"283573751331020850187069925886075930015",
"204731232221937085948434315753651673722"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-bc01a814",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b",
"target": {
"file": "vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-testbench/src/main/java/com/vaadin/flow/component/spreadsheet/testbench/SpreadsheetElement.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"90189125370997071544374365788492381734",
"22952883290610557320444950724107806109",
"40363020525227787396328421003778967687",
"126967311601152303430399103371801157151",
"153933206325780713787939423463694346495",
"319528179613358025847518819850490713232"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-bcf11de0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"141254999736853411589955063676087566762",
"124123435255544830649229379373588930177",
"155811608576675757373664519023147258894",
"289166073870852772515127063179132506273"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-bfe55a7e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318733234789774818013650823559243686166",
"155467279564625194386739517009555657317",
"200820764168340039774082095617125422829",
"20638871805355232654075664399420613093",
"182700517214039798156823143991123182341",
"232486954604430196409508624601680190471",
"95009472817351924470363736855953106800"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c05f9a84",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinNumberField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98895446551604758619411293596237418521",
"199484307610275145703672764982313811350",
"321043356010759443170303049750067416353",
"301115134745820776470104782720761142910"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c0a1913c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224678957177597718934526309793364398677",
"4619521005397853846112846261394986283",
"282549191241464396626287293544394896384",
"276223140941862987741957652856109397514"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c0a7263f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-master-detail-layout-flow-parent/vaadin-master-detail-layout-flow/src/main/java/com/vaadin/flow/component/masterdetaillayout/MasterDetailLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"309975468474318353839217021970465566637",
"333755489576190461433347906536437540206",
"324454681978454187514866780191748448525",
"294158281889822948694193604949367872569",
"159340278353462200744578785302375875233",
"163888706848604664842917367183124503749",
"196904199577737551040686418742049276703"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c125593c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"180141291149184250001452368040182158851",
"78905636423993835929364599924964625905",
"284996329903885579103375207063790022016",
"69750172001125068317260181957969991552"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c1722bb4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"333098910638285193024461847077643690624",
"222064814049316730459534335397256483470",
"234209131422757025936346482873363561488",
"224528267266378108805697411985575452397",
"278946569119644145080315528425767623845",
"198871462289725439308928193111063346004"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c1857e20",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/Checkbox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"10211340479860090629743656628918047453",
"197197139648245230132094037020417659335",
"281093077021474695394089753112861441455",
"239024325104691876018229511024783319125",
"246974244694991156405771888586260879867",
"118128784499318994019221069580147163366",
"36586547179933324992191329955906359525"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c2c77763",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/GeneratedVaadinNotification.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"92037669221102092040257544224481820280",
"190240983060412709191850445903652188304",
"167864057505512437866167909660207789872",
"250295545323557330221479191523461135456"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c3769f9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-aura-theme-flow-parent/vaadin-aura-theme-flow/src/main/java/com/vaadin/flow/theme/aura/Aura.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"177389250951014184170036257879878918626",
"220105238656871568294055386973303538771",
"282928620155138978538660882224627319385",
"220548810105824004597843205497345935223",
"243817753249758974462832626582626017494"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c3abd03f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-master-detail-layout-flow-parent/vaadin-master-detail-layout-flow/src/main/java/com/vaadin/flow/component/masterdetaillayout/MasterDetailLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"8812401745622458328013314935741214536",
"93360934688239340527432361430750653229",
"171634759256188382954495945082677015936",
"243461003899545665457202524035460502091",
"201163003862185359065176912970131386157",
"309513981656391665030823739605140455706"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c40a0fe5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"177730825871372786675754190791750619927",
"338936118145022616229490874091614496760",
"327292825193664473580486174633809916476",
"253611163241845551610714254604715099783"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c416fc59",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"329414134790064852884975893970280166577",
"282753974693224070737183650208337704276",
"92872956231527002948146824123797777665",
"160110925134789766287407968421647566431"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c4b2d919",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3342279977513093176970665938915846120",
"239833703289252027300793526605021379528",
"144933193019561968988947999866286125408",
"208725067024108974578700960554391822699",
"229386877056697493603325186648549003887",
"41249130166745236839110125269494868487",
"316678280554179526858592193552217055253"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c59b41fc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckboxGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"4827428237103416653736144511082013209",
"6426941126183938930805913743636175247",
"1643042893493962182316541568187031770",
"132816427414506108325402453362405713183",
"311277603720540673589321830646352421524",
"223914355692086726399853431745909410617"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c783b7b0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"183669286758542800120904956231759528192",
"205429302556979600339439108756404100555",
"235534367202262392586638265760869078284",
"319249785718410059994689155645158242832",
"210330053413338236976855956759378309607",
"110111601403662786138931812398206680516",
"156415189788446967557805847297882099586",
"201473658986729545135508816026288167087"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c7840414",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"131525592054914507540317179577882337130",
"125325056193731768725758745530362255649",
"336309790282939443550740241950851412860",
"259056891229067179037717484532349982624"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c79e2eeb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextArea.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240903965976209375421329703516528232008",
"73840733230380118058507984729680356100",
"190163264086625902320709659517683946632",
"12630390578715325660539733030003807760"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c7a4d233",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"53174304183790473236627236188218208744",
"160003041334328415913182453814329884097",
"131530869619032724116823952763895633088",
"123332006124899083121142119172575972041",
"75195974440879870880624431570385652582",
"57388169924170097358997252063778331835"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c832d441",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78395073329020520623438248192628040464",
"339104554699788170545883616731954947967",
"131153752964024706475984977886578783259",
"281919776274759583302666677542502911401"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-c8ee95fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"261096695847330342692957108235924903289",
"214863991200359001235698698349165124207",
"114585087282834650559152506162676086601",
"272401944667445204672630413858896526939",
"96353595438993873273713473312081117150",
"207008307303940956643571610714505083442"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ca691241",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/Dialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"330506471542515441354975643812961963540",
"198005943193814706200968990520913847038",
"282824830990271270683209074571207955197",
"57414479550169342827855373622836420056"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-cb14a039",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"18371024278773279009686390908310846763",
"231435679930629049933529924949343226518",
"260595111618089837212728137714059874138",
"255530565702648763992088621495545675785"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-cc2f3695",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNavItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"278100794721167360048137759916154341070",
"108262889008907096408631381616588939878",
"127821504474419133497086809258505977930",
"176869979778338198354915572869476972426",
"197765027633908488612896606814330877941",
"153924066422215965995045505689317574365"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ccc37391",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"121984601068339227434759495420254420013",
"158256370065199787613661701746142236260",
"50476181599199803337256754141180226403",
"56244522438510497011926982637315837141"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-cd983f47",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/Dashboard.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121197145329376912083425646820988589471",
"length": 107
},
"id": "CVE-2026-91860-ceac5666",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java",
"function": "onSetEnabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192923233484013268518831943021142354284",
"157876665848436088383765916788720493587",
"55824247868731363346765442643881428274",
"335767160086616160531986363660508886149"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d10a1ac6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioGroup.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "89590505678001962171649155691520374787",
"length": 53
},
"id": "CVE-2026-91860-d12f6b4c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java",
"function": "setup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"260747726235634794993902707479722896541",
"274803150691726496786879479267409702927",
"254889689084794453491094603592138581027",
"261080555089734841723742780926909350014",
"167196598393875690145642349052954543126",
"129034739790214737723583443118181997222",
"138704386736152255969783093637196845325"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d50a2f7b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/GeneratedVaadinRichTextEditor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"55867907455324026252842586293913473620",
"124279539426604187219272716934866706634",
"172807652329336520626385706880896064320",
"64159016542915641345037186697218679612",
"158896573315694351887464014180434797997",
"291535468425470781956832192260275694922"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d55adc22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"95092792887154945876297860936402035741",
"18250325302498486248454926231119437039",
"275587563386256548460098150364142300902",
"202737657364513432027806318241017588751",
"182533260279693789486370646932500423801",
"193146619926538000627816471212370809238"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d5c4bccf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/Checkbox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"96253781867492923467567753191667624152",
"27495192199598629596932909769524064210",
"19777797266879284197046101421355569555",
"166751356161050925113629504721460904355"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d631f665",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"226855994141996117475076780153428540485",
"264534135685506260461601246905434241130",
"229624474653673918765102315826200029534",
"236052383437861261048700258546331288398",
"326403687717605790144277921472401249406",
"23806425209920162597934474761240600932"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d6883333",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"205951376391069267196604803010773907500",
"4429185846125205710042750124718142523",
"253227547494052602564895738491455719803",
"157828555541930519647053402094546558080",
"305770883340729499432310333623248077040",
"117220362942526222545941434261084873756"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d73e42ce",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184820732948850618140671532857375926357",
"270109894138226848586803395009304662431",
"254284928612152137228660671993137850075",
"228042695521773983100669147966890801639",
"237985893107015460913338252594878977361",
"8707089422255774151057341133518027958",
"160675206649894703226676680386500833910"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d80cf431",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"232562083477994246111525205191154934378",
"167026745855539056612828163865245895028",
"219144990544038540987374521677272060052",
"169743552228910566575927987996987767652"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d92b7739",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"54120876331567284695602192080939076036",
"117913940121280536531590404252805944331",
"177124484198627963711523283945303378489",
"156695881640265206010360041180231201257",
"294227337398041693403898550988159693138",
"198899983454843694563503985821113548030",
"285619449932104951334824460786705087677",
"135009687869955359789898495282584875540",
"294367295064759541093190936940143707248",
"146234329776338507843145688569628168520"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d9421c83",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"178409859599580364076013607338343161641",
"4283657693119120559931922632528619753",
"270090802447780172166548921189979013831",
"95996965933070721681184183875040009081",
"315096021252706098078047898089966599136",
"122451842872007571377824584353444128104",
"125878991264999283972105658645987241747"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-d9bee8ed",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"147669706542717616439282489690739247534",
"174352132234405669341520822581396995963",
"144041428412646472414677686290797476085",
"91678603034938714167609422266820857069",
"175482217806722228465822415951516733884",
"278989618549371147626777820408916959827",
"61900266636437648613916898349232198225"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-dc0db0d6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/GeneratedVaadinContextMenu.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"38333526010080923774144984987436253862",
"312064588604631431423200153242833140581",
"135146039892167325427567347385600582395",
"324197070547200402649772595427228435117"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-dd40d2cc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"52995085335349422927189027908948073897",
"189607026258797204403989474405849884517",
"139954651465756643098670647617781912383",
"207963322145916820614406141981438340382",
"259372674652144344154578017219247243933",
"210390150033737300945364585131220571623"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ddda4565",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/AbstractIcon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"18676328132211688880314801964157211545",
"181491188177085786915935873443388485065",
"129315625310577407291526703446109184991",
"270021243541139207973004647489683418500"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-de7ad2d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tab.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"219136172111017897538951743229443599289",
"173339119635653391869122539730305117661",
"241416293160508843389593859659777565584",
"336688963961851977502157171770680424139"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-debec9be",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/Notification.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"24588367150627522803636823808920126126",
"35540117873352386583481313303616751296",
"197889821325157595070411410995730237297",
"26935993793985600000481123661025490379",
"267039698358003992240218533242898572789",
"339976198511858155303440167252006097236"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e0388b13",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"24669750679548996546371324026464379686",
"176528683809949873575372025474285526151",
"240333772083244360887495283655853560690",
"22507232240435940719390395970335637054"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e18d73e1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/TimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192296712265805911827465241878700714450",
"85160900996113503128956864962449100955",
"123033110637364046102402564600393040007",
"14724920941767003978379020292356879963",
"328168190565018123612562488294530931178",
"252822266523987084777592728934114258675",
"99509896750817620317110092883861233837",
"139430338815560722677403032253587117292",
"89682221290037726859613428174823396368",
"265587249170633488161134699313542747946",
"183342365252072769986093456072442539639"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e1d50fb5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"191860439106752249323021692860699066204",
"71464516573781233228314870475162485668",
"32408176818192687400076215958244348394",
"23185627613605651595169475830325122691",
"94428060390787824053014581862331692670",
"324118995694503812041571215181495403457",
"217571457287876582444692797635456891024",
"194129018500960397843216166133903039185",
"83616179873273858244473773622149508218",
"59572504711267720040579070320943001315"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e2987258",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158956854173862883231697465835802204795",
"253071534175469986882012117476462793055",
"147415372569674242283542252767042408708",
"250183497971373303027104107435776257915"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e3c83d67",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324909108812765643266717812242778839075",
"200552509115702042003430046821141610998",
"56738266207580052426548621755525977767",
"127018133913730763154795885067442767345",
"109021474288552253976742408986048927206",
"246696404724657062107660992248567184849",
"99569988497630327971142390919684155857",
"239746907180037256391592543379595761991",
"58367914662732140014282050217964270162",
"78845629917007595518444751206016985727",
"277962491704580245374287124712531228621",
"55780067355118373281107346942729864437",
"63881982723800020823892555988820619658",
"132470354739878749983414191227494879701",
"138990014135576467422026462400178069482",
"177079465727169166762267521853013049631",
"38757122445383565964990273687221181121",
"156464195493341667508021394325398778961"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e5e38c87",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/FormLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192329059073254750513606212101221384874",
"180943010683760263249829063912135678243",
"234410037697209723780524979160972954692",
"151047092474898276114688905185862017636",
"223333410363344982017360321498412900372",
"138430943657945561151306684875164158991"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e625cd58",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60466015480794084010896739354381646870",
"94452847701506055991667276160908646860",
"181513117016016316911611517085885079091",
"160824915788772081597022225203571567048"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e628a3b7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNavItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"42046496615389474478454136954585574973",
"137213126093052780028648860988193138426",
"30210259674537928935746376912896751093",
"312503973570325194459006266512405338310",
"1644569097599648477522497553528839129",
"133680208679220286926930064643466881572"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e7333931",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"176352780528610596352829206914850699578",
"204216569352616418805820514424742952613",
"79746905926501995262444978647515138788",
"43831578632069609362337829713533229097",
"315630955067104020032261822135241002266",
"232780999100578530199219697844990648234",
"20292534472759026292110127631612979210",
"217953999189421067071060866498281131599",
"194229892343777343755897957095857300227",
"223827178649159926347602040964154700856"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e80b6469",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"5857785452548414755817266145956795382",
"43965841130739584877693565112681674380",
"28359387996710298105157072281698366073",
"97783492159759310902151213099048037680",
"238448852279520405248344850452520791884",
"225601996721719793524705491405578243232"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e840e285",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"236365180443322534775786162807195468276",
"73881263462528490227162792187723418805",
"335050402150907510262695574844648875798",
"76039225499072543023272505724714802083",
"211426072065987685837483016118859488123",
"333048899618785237785388157062487563456",
"307531424693958850275883946342086837797"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e8dcbcd7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUpload.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"257075176557295510969553898176365321895",
"36143856446284484986314357789197955826",
"84243838432235109917043645487402641171",
"98143144375766310238982139924705889397",
"43163238689032577522767671275458556677",
"253564246767682039351266270882408335464"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e8e62711",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"66580252344200800708728825054098696005",
"55735781271644310372780299316643117171",
"89952733468002869539959235378239290144",
"270017455515672349929760184678466519318"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e8f453c0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"112376591443091395327729255899770849435",
"96055444853123236059082287216788959413",
"122724927486030948856847641272297905095",
"113989993386953165702305104552937161075"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-e9125053",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"150342674734279018986913311984364212764",
"189116479633357713319841394203537225391",
"198904821055134531975397790128479991435",
"174491146136719261195563337129392836040",
"278575921083269841775987260212036186253",
"100193789278360082508201980135663752164"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ea2ddc17",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"178409859599580364076013607338343161641",
"4283657693119120559931922632528619753",
"289523620694156504099617473779800837597",
"86136592345527115335113386937895579247",
"221119717870450161430955983963491747771",
"291660602038352213162706322264573011905"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-eafe0808",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145722886291486975660814916767687441317",
"283398575491932292468532871084502119686",
"337530875228623988325589722572741429325",
"263756645803717649572025911434993844122",
"232699191331286164389851153622882572691",
"116808368600302846366045506628423013373",
"270471735327005338892394628088495860680"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ec04f4b2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"248330057012495454487572247953246174461",
"180204442388735139397723466421837262401",
"297080339719520426227060288276558130611",
"306303978961281584570462686019620492582"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ecc391cc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13815067004143069899543111882143128586",
"112103474674105255932396273055809967741",
"236255626843846869474492473876312675929",
"87337028172708518251727991494507798789",
"136713122554479542046698291512585744007",
"119720610838441859460780518991162769707"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ecf1a557",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"226822749821337913641329762953286101378",
"1243651383976704865932335718335942715",
"254320238184914372510798270985596074814",
"60624482513920675153949126679280807704",
"147717237882824056457926772179762234338",
"304775695178382242962012828589488802445"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ee83c200",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"51029728141426927443423404407178553455",
"334000510154668496340587742469131849424",
"29236368053577212028739906069307788975",
"3480324751336995277436978602762206271",
"279038537399629182634141154563017999227",
"112680863813770671988555694814399029503",
"143774145619136551772930690003327889904",
"205336578979903563054761540001696075939"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f2c30c15",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/Dashboard.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"12448788347901060262680827741367619739",
"18698722509563948865487027471465110243",
"250584031738477184849124641692573647288",
"35449937819355197211247567518570563980",
"314800432085723460941030117780871019998",
"111597249665721741040264613142628794680",
"270926575980090071813408269729816966497"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f2cd9c6e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"197596570033770273773293023317835702404",
"236240336678623817767030109389623614063",
"167713673852960545168154780249999720175",
"191664132846802933723313053060576243520"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f3379bd6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "289850733904819289915873124456125618015",
"length": 127
},
"id": "CVE-2026-91860-f3a90ee6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java",
"function": "setEnabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"91951028405885603529608464456588725075",
"77515960301284391342811942679426384704",
"309344694132254390131530760637693199564",
"329874870270164966387374473972831807773",
"323398628452972801463737859000682208179"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f3e3bf03",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"269599490507348265155871257285457494757",
"293743657593898740743254515732534430018",
"148453650396426894300535045808193945880",
"226864904663783040927368118247690474674",
"302562061313341731113382409032495294309"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f3e3f8c5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-popover-flow-parent/vaadin-popover-flow/src/main/java/com/vaadin/flow/component/popover/Popover.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240382149252733595752779577296411855969",
"101772293080948172956170602989154569763",
"135227480374018299140246201256205472469",
"197828055984619559121822908012482629926",
"107615839872240406063989613637478037708",
"113496577171116847709610927543347904960",
"55989134884685624414937857417269361306"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f41d784f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"274932609149040602298771287482723707517",
"136050666714196085767469343603152023202",
"251305983740760768228582313271575161955",
"312634668288649058274394667866240875579",
"237206473368635964249828133944563834054",
"46296216548563532178304529595261822672",
"315926590596661818385053696774783007129",
"128052108392616781300791812383509892441",
"160897916107016636757719525330465840860",
"102132724580426537946533940885437391632"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f5c59513",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"265631227800768841306171652072786034344",
"217660123443000721196813742873901738535",
"324684033440579997215617166673972922543",
"244567190959457820190723151019118302502",
"77948346513264943931701959800074989068",
"290760141021442150780193008997587982763",
"117538546644689925634983381931650120096"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f61820d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1",
"target": {
"file": "vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardSection.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308665252251722873145388895931131189129",
"186037273815994831668880381707926035942",
"126263078102742853744189393412346687853",
"273309716519723668405782285685164996321",
"134186575095070449518200754652098371651",
"231592589758450559982797079486843689318",
"263600285041018052271331378962137191860"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f63daa53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314239849463081837626662116026871919866",
"40819544071635864086280156850796281894",
"272029294195998623524008600937468662779",
"308004743110581958677270220773178843273"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f8abcbf4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/IntegerSlider.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94276477646408493954832018507023940547",
"182757860137575702682416780546250514954",
"242107709799511023902588548051151381608",
"220587816726680317879150837659690276562"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f9aad791",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"91602766336236244725148345034290213031",
"85328319692893120129077792100927953557",
"109887592070605157179953747348562803453",
"227862431324833860908002770289434239475",
"276387030835032080432341915769555542539",
"330149476858262999937475748247749763558"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-f9b87356",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"24354024704565345802620814345329621743",
"256648862011601953081470542271790020661",
"90007898484736010347855205367532137018",
"209921554060191245908162941839479592725"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-fb0506b3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498",
"target": {
"file": "vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/DatePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"212894634908050527078725364152052580965",
"307292250101476237235182186792950756766",
"142077084051161680528232464568311666809",
"242448118962459207728140458397209068785",
"22657925223462645614219185068903368080",
"271682615335231000653387040404729496582",
"247686769594953430977488367028029236169"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-fb2084ff",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tabs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"9508557071637399550161041359353687340",
"59837937218965246552980404857641107259",
"227667882449032880771003296151132573151",
"207810676513227480308055326238014648283"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-fca04f58",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"74036628195031162648256930464928504390",
"238055527559313410322425133710324530348",
"224087161184047869577774296226181514364",
"310763007157685094172649024739815185410",
"104217364667103866705107284182307928503",
"176018216821294332387894985940057477890"
],
"threshold": 0.9
},
"id": "CVE-2026-91860-ffdfdc13",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2",
"target": {
"file": "vaadin-card-flow-parent/vaadin-card-flow/src/main/java/com/vaadin/flow/component/card/Card.java"
}
}
]
vanir_signatures_modified
"2026-10-02T08:13:41Z"