CVE-2026-93547
- Source
- https://cve.org/CVERecord?id=CVE-2026-93547
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93547.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-93547
- Published
- 2026-09-30T13:13:13Z
- Modified
- 2026-10-02T08:13:40Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells
- Details
-
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.1.0 - 23.6.13 Vaadin 24.0.0 - 24.9.21 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Vaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0
Mitigation Upgrade to 23.6.14 Upgrade to 24.9.22 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Upgrade the Spreadsheet add-on to 3.1.1
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1
- Database specific
{ "cna_assigner": "Vaadin", "cwe_ids": [ "CWE-285" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93547.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "2.0.0" }, { "fixed": "3.1.1" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://maven.vaadin.com/vaadin-addons
- https://repo.maven.apache.org/maven2
- https://vaadin.com/security/cve-2026-93547
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93547.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-93547
- https://github.com/vaadin/flow-components/pull/9905
- https://github.com/vaadin/flow-components/pull/9907
- https://github.com/vaadin/flow-components/pull/9908
- https://github.com/vaadin/flow-components/pull/9909
- https://github.com/vaadin/flow-components/pull/9910
- https://github.com/vaadin/flow-components/pull/9956
- https://github.com/vaadin/spreadsheet/pull/866
- https://github.com/vaadin/flow-components
- https://github.com/vaadin/platform
- https://github.com/vaadin/spreadsheet
Affected packages
Git / github.com/vaadin/flow-components
Affected ranges
- Type
- GIT
- Repo
- https://github.com/vaadin/flow-components
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "23.1.0" }, { "fixed": "23.6.14" }, { "introduced": "24.0.0" }, { "fixed": "24.9.22" }, { "introduced": "24.10.0" }, { "fixed": "24.10.10" }, { "introduced": "25.0.0" }, { "fixed": "25.1.12" }, { "introduced": "25.2.0" }, { "fixed": "25.2.7" } ], "source": "AFFECTED_FIELD" }
Affected versions
24.*
24.10.0
24.10.1
24.10.2
24.10.3
24.10.4
24.10.5
24.10.6
24.10.7
24.10.8
24.10.9
25.*
25.2.0
25.2.1
25.2.2
25.2.3
25.2.4
25.2.5
25.2.6
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93547.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"139804014910014082595759955460233770290",
"157644513574755650845569825419532975039",
"13232134451527595369833234952243738595",
"336566875528174846137098077993175895057",
"43994750812215959662748770726165405120",
"85708241196083166070456182395835209029",
"224919112073548207090173162186740444094",
"327773519430404555652577262843872459845",
"55565235568084177155465310458437786532"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-01190b12",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"43510491227183790451322630924295846261",
"275312833198246850961003269078561136624",
"67295578828912037526655496466693582571",
"184082853300383203704105311043223456386"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-0941bbb3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"337639349341496073403452413997753134055",
"182136995672750404607740388441871829705",
"197183611667140176443676879901914426301",
"64841229518222474182086907596992935989"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-10109631",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/GeneratedVaadinSplitLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64045124586473418993041872196765760319",
"308804806241151468289307997172361938751",
"247198805478875923307778728005517095299",
"186734422492525047252513442279965703950"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-122bd724",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"11926996932901548406771578386876292593",
"219471549892987520333288078632757079546",
"218847027540348572831367480208694293592",
"161137083081090691540376690829134892574"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-13c71a50",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288807544109764305603697632221890652535",
"87669936466187709514147407089959997451",
"176873081771583475227713670220193740817",
"283938057880133635805696002835834229712",
"155870715150561246077195289032981572172"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-16b4b062",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"264886082386068594597620973772576322653",
"339552908121151548546411364592179598734",
"316468174699773892762939957988915546083",
"270347554342506327407917489379903211551",
"299873406723067243495889307874406772659",
"253071116440112744627798904430161236320",
"209316402439564089791189399690490103587"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-173a2bfe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinEmailField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"65261207034701126607483489281406270662",
"14544999484550580017910451622633443926",
"331844193854727060947042346539745283940",
"253611163241845551610714254604715099783"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-18fa0bd8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"226718785279738169227864701510778095580",
"101124390178524459373447064230432030573",
"67873178327611045266091594984982033959",
"215616079332197731098993670623754149511"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-19e3fcc0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"677117734493331432316145911839233197",
"160213264377640838067153238700837890490",
"328461641808303605742920323737810081743",
"284965866372647701917069165497983973834",
"188663203908123076233390873269441551587",
"309847126066467301921684163740419395755",
"258653698138359134022654877744521040729"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-1d345d98",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"339358128199368660449303409421260137716",
"50859895656435089643606463987027579135",
"85200415459428684127076359124480213873",
"121086627409195035758333466384665493163",
"196459052972410184312324334850447117093",
"146569395576243949732748963256078066650",
"188656282883376723791402694916328283116"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-208e7a58",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"191808895912370347516695747938319400166",
"278464140399482312505247196505016597059",
"37831724787940896097335978412173181952",
"228042695521773983100669147966890801639",
"175791325826089812110533623204205660138",
"289634322657346398850163851324953878559",
"186806798073385807651842146375817809752"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-2096dbf0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"176462570933424815658047137258311676296",
"11804231312275787404598469476240772286",
"237064518287325444808860864105251146283",
"12113835077192690950412275839293301343",
"227143884354788317902376880792080660055",
"331729605430946958981696168837120931667",
"68203389204870834201746409303363081660"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-20ec64d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/GeneratedVaadinDatePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"187878492917358939303207349002436227632",
"65183619752008960595600515257969025756",
"175348754033651330298254900868356312679",
"217492588439935987009082552984441764973",
"122931687290364272819553630118007984411",
"5266620351163651567050367023060434760",
"114360412769718866045781607393166974270",
"232090047897335170397444635575195210234",
"240218483270638901428053521174419739162",
"245107801072664225405818235226806557965",
"90637910651623701523977683918065105063"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-22c795a2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319335563772636922441838168443882415880",
"191962149090652637672230472863835465396",
"273814512111863790569336450491072506349",
"210181994341964362488474114937120362408",
"311035585269293114669641902533751291582",
"239773814596530463941231860871776105213",
"129150706120547662184561353077942454000"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-22d5fc43",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"57576137265725683361030683898059436241",
"9784372319100683215754767622511098744",
"222370475748735533613936567000048990526",
"232195050182601260754401940854787409012",
"188821404639721968343183224743250648857",
"130881945820937367369054854758540490301",
"26847135543689638393775422567550366837",
"239494238228205856391532309480088524931"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-24ccc3c1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTab.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"310723032833634798599800289931119409211",
"2099159557420148499595097462776673552",
"20513334240292002585711973050871101636",
"193806335394942766725414533603392981548"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-26e7e923",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319886305313204774108013156926536192936",
"150395070036305921884131467670221598048",
"102123083932101903230031242085604588729",
"163032960490188177649277847772543802850"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-2876c428",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"115741627196033955352740076878494525557",
"12090350657536638073904665362396528545",
"101705517318127877902703184183789934088",
"152233282415911041010281959552727861777",
"193456814348297137911212479072491760205",
"109723050929774491613756726796354669932",
"33016324394107199248712789547205850548"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-34f3ae52",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319335563772636922441838168443882415880",
"191962149090652637672230472863835465396",
"273814512111863790569336450491072506349",
"68207926509279664122118898628473381260",
"187435772876896398444433897018940467589",
"177931250631534213142782163970362183460",
"29038517509170570206558330634759579926"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-3a740919",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"148894924585365974642268941180823793989",
"205122796566615840020368803338149832688",
"4594601767935482560184412717222600337",
"51636861566931085158666783594938852877",
"252244327282403336485088762507028891446",
"31011048963010996575177804786949457232",
"3739999029154109081550460632421053991",
"293094725849694205411446862249340624511"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-3b35e291",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "94215097563696518968142770020851707059",
"length": 124
},
"id": "CVE-2026-93547-3dc25619",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java",
"function": "setEnabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"122214457292668270259616897966086856158",
"284868926174609364283242610964408704958",
"308579315570955473166196606396787837945",
"118863128363336726872649250392810598406",
"157713642203272456630450319704120225619",
"304954206707355744734948918909963245779",
"188628152124315505580886960743122661810",
"263562954493957973610699789735507356530",
"259532268690019241572784185038585407478",
"190616727812425483973702406763497022507",
"140960119378718788711635754128476173336"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-41805a19",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125542708423254180184490501726435776211",
"285326487856755650705580980438075886426",
"252093910142031954120233202640959430170",
"145179201001583151611475073460071351655",
"71044882135712510871477415856482053537",
"95216166418836703016698099765570302407",
"199285825967559726837200400213781854275"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-454d38b6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/generated/GeneratedVaadinSelect.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165968137833737408160637340064193260666",
"214569625351503208711812290184090583754",
"235949935109141752180416121379180788889",
"91103122562431492031006384456842969936",
"71309471997345684108042794883609122409",
"12315998428467556154894715146980870935",
"96165518297190150486800625269449151755"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-47c9b081",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"29143086595964715638679839335964555436",
"197484545637239969173300077852872208166",
"12901518315434289807934191433575620395",
"256085568011290674787323188557374733153",
"166584884665947565823818159338178777040"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-4c325123",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "134128486111753383408977196812965987078",
"length": 621
},
"id": "CVE-2026-93547-4c7a5c87",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/7e3951a1ef87880b6994dc69966c5969dd730c8a",
"target": {
"file": "vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/SpreadsheetHandlerImpl.java",
"function": "updateCellComment"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15698723147241475930750619660506166978",
"128555961472113491233200122454670790249",
"115274807142504644087023868638950057113",
"277457619339576881844385343413258133001"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-501651f8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"161789032417775497927028249718519807782",
"295188965970819343385963683081255486952",
"42933334843854916521104866664477727922",
"3216241012338932786639023110765854070"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-50bd679f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"109099308319594873921528275837220308588",
"142429247337826247633249731870136759958",
"233775504849881222799801841540070473483",
"165119053358499097601623809758969847530",
"243196388267204202737234894496400276847",
"89764715898966822222390877389766815997",
"253855398323365199244936792947038376290",
"273556940925835595189723640177595251671",
"115660092913163023514208615922277110685",
"11494545405891050460251534424069639681",
"83058234698690279094721657936699160665",
"157307893810061268982960113253866788728",
"41321985310312895987871303574956775995",
"139743062104737638620488794851827925099",
"78486513658984066616140717383883970104"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-516a39f5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"300826378304734914384370620371318123410",
"109355843476382320286417959182311815101",
"239926748279198558638184990052482578327",
"29406460051694085704676060758007442464",
"152546706606826330494638609122572832129",
"163410448430256130578429428470909854319",
"193753302363044114337060192692555588050"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-52fb2146",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/GeneratedVaadinDialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"23915464060710696087093548938400709203",
"296891493060618395130466698131365893180",
"221679676065858660553951247086586331214",
"272240179496748985686775716627170322054",
"252757338102080358672145075646818532343",
"91569646472235957676549351189222665045",
"227048749957502766678637860274872565139"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-5efba4f1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"331695949661642704054358543676425196993",
"130082900393848411472914659772066510704",
"278654718638579125009443920264070020237",
"103105773234313912841403200130872626900",
"68680838279358822913179183397277559126",
"22794154688379504767843814072194529010",
"243375664151456322202188921250557969544"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-62f98fe3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"133692119156590038724960648503878388387",
"128799939694515685140101245758848655362",
"66895408611146281818575319932888804466",
"297761285997344584033497421090789238355",
"91047348625361866104586324859834302900",
"222640208638284573934082880350817430565",
"231257574783938170895854250570117476448",
"193891923162156337782198482712842965396",
"231641059062251897602530987003028083978",
"198462424370723068282635268499212359372",
"213046146385460822868339206060287575225",
"22908424730610608225943025312239326876"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-64f780c7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"10695398993901130126524256648111426756",
"71088825340520715117035264342596952622",
"298121506233416827925719370144078121969",
"265902173811208154901801579954188507255",
"79950434984058930922753047753947397395",
"15525473410893240237817433022336524429",
"251051406288606960212531596126689067364",
"142566843632775685958365403892440461981"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-651c9911",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"22608943814735554080260452743789021849",
"255672148858980605281042921763497852876",
"297307368075890483644630176272712766374",
"11992029449152443567309608112944314266",
"303845321096730943506688281587233179176",
"109383799550672341692102976450407950532",
"257160395088732415267496068560189532121"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-683a3c4d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"37954593981273224711651226117012275374",
"50029570256929089570759330400766271728",
"49509070851887386787907590323123065782",
"11992029449152443567309608112944314266",
"134392995199879721010538339736372947234",
"88623736752635021964856203766557704040",
"167635133703589878233420053367415801339"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-684fa8db",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"241689171885620782826981589845663004777",
"299616126575864573876546891671612518081",
"54830249824303220446958746624092296859",
"263782993191051094061743760653308064638"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-6daccd77",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"256787771069965889313325252634824664212",
"124813820570030010825344953833040043683",
"209834052222992558832033990883029798149",
"70339247302726660819422390398699956562"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-6f36f3db",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/7e3951a1ef87880b6994dc69966c5969dd730c8a",
"target": {
"file": "vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/SpreadsheetHandlerImpl.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"334233500371833792753575364112259844628",
"284153417450888717578420138615768288735",
"188485950816725313378128281625837796446",
"114402648547973463757447937287298547284"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-6ffc2a03",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/IronIcon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"218862919199480754051629337260538835454",
"124951472782991165983569559182773423930",
"12404004292233203819400791899139090814",
"176168551134820289968728650782907125546"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-723e8ccb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165514547439980300028062992971534138879",
"197736796814260515462926292968769301795",
"28567907427771622444594021055117702644",
"121086627409195035758333466384665493163",
"100692717951015748919787003728740983249",
"208842102433802380174781413921072434269",
"106793714606155189369913400520341547072"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-72def470",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"9486403756278168829181911628021249626",
"104356880514060629591554550210751516088",
"133007495947680000070408269365694609962",
"12743654030765929263470535305973498692",
"139196424454802799599119657153757607969",
"327674210378814045462636197031106408964",
"256410201959885610488855575299852273346"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-73018cd9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"296134014643193894687108216620192861202",
"150076420155488188747186365406386646575",
"58308549095909287863561501069992775605",
"218467119670865233717677283628302079794",
"91605728170722333859935741182843980187",
"325101047337923583092387400877391856847",
"27185662108624818765404783584005661541"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-7679858d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64226170934336236073007597738702317760",
"207424279715551666644601135288349175006",
"191537745693800899161546529704068355154",
"289564311499018879947485301797170874731",
"66809657976619777237557298512259981855"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-890ee491",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"17139459073066948577597065442463722733",
"238370078926877545422041364937098904025",
"242993266706821184277991774083634041766",
"332292535226721593041079559061372192472",
"29073209658698636902063524831228222573",
"7064186056011437102597373108829099942",
"271167879179362872872949303908286764581"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-8d23ec31",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318169978420655560834861458604140627385",
"201241979948086642080975612603467551591",
"289006815259786259767173033557327588764",
"3035670795667065395203864972851072781",
"184716445595699671364714982228250106602"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-8fde8059",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"286129081824461912373386685418830838504",
"122696600537683304201517824359619617954",
"331499159739763707425498094410591953275",
"93010352653554887474572428483108300692",
"296135578515743027946389472736410346002",
"335302875285392095343386765465369235547",
"263894116202172533101595019824822189903"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-937005e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"263932228569716878028493654794287555373",
"251520267803906853601443427278291596190",
"113351744021313239603160655734773573898",
"160416262712267843847167610626014510564"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-93f309b1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"151861268607778617528442703297741355291",
"62997444179922146649000533830357941312",
"41933201836200407367609330097471767646",
"172001675943777915675869389875081093441",
"289971105651836865924670331962781488329",
"194788201666869751516466351063789372735",
"186998710628045208448839329807664559585"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-96ceb930",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"270064432359579580076235852296308999471",
"31297989078224108306026391392933587062",
"193640368209559062201530548907812445381",
"47349015229353814134605922319423142611",
"31780099556070361462176726419774538502",
"53467278015159944524510335949254227670"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-981b9b72",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"188955872903654492216388914638133212854",
"96067614133234538814144289917933158223",
"15792975074872021262673902516588493961",
"212861641974843638425040798069764743113",
"48435976830759833605795897185317759421",
"25807009063683446370478853981472653538",
"255002618588899229101184740783834607058"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-995ab1d9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3747459429878414448462577926462842449",
"218524146567427119372410935870638425896",
"143859476620716492677025939397642586699",
"193347563249656837090940636136910768252"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-a02bb5fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUploadFile.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "8186637721138874716787329503259068574",
"length": 123
},
"id": "CVE-2026-93547-a2ba85e2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java",
"function": "setEnabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"21227522182542128695877441772043364054",
"280232788834897151624455764562425060218",
"326802776617848061725822318490912768969",
"124621194736784945557835360886083322751",
"176350313577864214163874374920187502319",
"107149033961027880252532211751204042686",
"151504935647717589128606775739355363416"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-a406f317",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextArea.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"110884903166894414314094557662559942039",
"206630681242459063977873026595980177567",
"38500256514598055381437606712815889267",
"273309716519723668405782285685164996321",
"284309102270475709302381221947756978119",
"8916090830652495843285792880063796135",
"170452268445978674027321881128146511287"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-a52931f4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"331840309606413920329566731680531077261",
"325775648053078910998965466605552940276",
"188513189907641937520674316385079768433",
"303556764474508714310000007550364481805",
"98312673574687481808221658700288328207",
"325450817363175960243334315341871449741",
"128656164862467941083431583963133406895"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-a7efa864",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302266890798810844425583005350020712785",
"20653944505422516373720386232501031556",
"47268719125627302469474966406424366815",
"203545127554392161980370111385127632494"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-a9b8cb03",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/GeneratedVaadinProgressBar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"35042164962131879423852798472665158984",
"334338804907630990117763142230653398557",
"152085211708504497443025724518187746021",
"313393773274946483677080789133281606609",
"34275494161687850458375209920254636276",
"41417433753614015572062946356799612718",
"84329100855289328211950208530206453166",
"85313434810737355423842705408109276654"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-ad365234",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"290602405391722824758593884556281563324",
"45562812048430893566786838410913597554",
"95962027479079802825658536394088414982",
"74378206895964183901043479553977895861",
"302652901202117598265292436594201667966",
"246395884098897398283115628236714287501",
"68574240783192397774013611505769785725"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-afbb6094",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/GeneratedVaadinButton.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"157618035939260416624303900298176598989",
"301373085352754471481466939801004927416",
"209047635362721052828370708416842238722",
"57149809821657081314195817723156614097",
"17020392855735474254904159052154397284",
"276226431468771808046151862758969302532",
"44173318426708978767428596523017735001",
"75385984258550474494979230331427111655",
"44577620567949090085282011164139043283",
"291006460486519518492116388394468770274",
"192777481132803751958892886508463001286",
"188278385786347862102741975298703166764",
"132795863756969832695605223751728329676",
"190383862081031616478265877132169662280",
"299607987853524260189308996789227812560",
"137747352174428328055239541980395793306",
"337991211691687789478692762572733787919",
"20852170086004971186537977360973695699",
"321096966137212934089768556273678824177",
"331225987917223565639750072257625483771",
"33418372602960645112421985380394916565",
"43921841694542266475714577875484314694",
"101964898985507069036018755971491519274"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b071f503",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"264810375198202281052237583333885872748",
"120330610410566778273474244514535347597",
"126691195870628948406246533844756236586",
"59899086060179810590802816856019812605",
"160831976443012732529543374476821988804",
"219787878045153420824300055572897279452",
"308194455916845101429284089933925160619",
"247534912660287641774070804226394957948",
"191151246788996757670849488782924154784"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b08c1a0a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"127403949388793812751790920998532279342",
"171271229392313362031687611679415814400",
"274559978183589632573428361096790644816",
"262512437039626970798085267630357462772"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b0e12764",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"36014278876800646412415183710643565081",
"69805889774702802594681815102630197897",
"265337545633700122557546308763505064160",
"333730949719838316842232000309093880656",
"329683297791299968690113918906685090906",
"156478663263092608479511778792929503684",
"337269462531029046172730568955292921695"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b23545fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/GeneratedVaadinTimePicker.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"249026093832844837766830785197691709380",
"227912246111322214563542748846531056106",
"151336125913051794608279045107913018923",
"321317797643847083961534643390412351720",
"207249037672481594696392284328317296460",
"185433344719776604986282149734971586258",
"52444827414347959589929221579200508955",
"285084676521978198077518627414966803100"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b2751482",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTabs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166991970097207763098882341709530345157",
"99643428964889711427624689777016277716",
"36002910287982724568136914702364550851",
"35735164940356661782080437227165139322",
"199250534797027582648617535250989794050",
"255367305213772629138460332344838658936",
"82095094985122493580687082607073149202"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b5a4073f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149286409461437386191953540480133784087",
"49893343540222275457444686606027682991",
"249811514533215902220728379827826410075",
"91103122562431492031006384456842969936",
"121962156312976409413971193791180840985",
"73118177241664850946307267252691107143",
"174667181549613192901529913923084661747"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b64fc7a5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16737564262995772171574308722993530448",
"321044719298573500035259504410505310738",
"288899636742328523412543577990877804921",
"15212173775034213636395645419930287312",
"282523647538093995213764344493402038067",
"15443124746952533375991441029749541526",
"37014539976917280432164335953063216599"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-b8656437",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinPasswordField.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "65313709292149367055722205061676845717",
"length": 209
},
"id": "CVE-2026-93547-ba908aa9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java",
"function": "DisableOnClickController"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"133649201688321882713428026178444800203",
"161460649361402428975023761658687440207",
"37471200067585969808876757234530854469",
"132151675085800208527943916776512595085",
"78599188599561770387804248239393072746",
"240484443808672308446145218953409535267",
"77976230274680133791950358573498791613"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-bbaf49db",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckbox.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318733234789774818013650823559243686166",
"155467279564625194386739517009555657317",
"200820764168340039774082095617125422829",
"20638871805355232654075664399420613093",
"182700517214039798156823143991123182341",
"232486954604430196409508624601680190471",
"95009472817351924470363736855953106800"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-c05f9a84",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinNumberField.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"10211340479860090629743656628918047453",
"197197139648245230132094037020417659335",
"281093077021474695394089753112861441455",
"239024325104691876018229511024783319125",
"246974244694991156405771888586260879867",
"118128784499318994019221069580147163366",
"36586547179933324992191329955906359525"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-c2c77763",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/GeneratedVaadinNotification.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"177730825871372786675754190791750619927",
"338936118145022616229490874091614496760",
"327292825193664473580486174633809916476",
"253611163241845551610714254604715099783"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-c416fc59",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3342279977513093176970665938915846120",
"239833703289252027300793526605021379528",
"144933193019561968988947999866286125408",
"208725067024108974578700960554391822699",
"229386877056697493603325186648549003887",
"41249130166745236839110125269494868487",
"316678280554179526858592193552217055253"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-c59b41fc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckboxGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"183669286758542800120904956231759528192",
"205429302556979600339439108756404100555",
"235534367202262392586638265760869078284",
"319249785718410059994689155645158242832",
"210330053413338236976855956759378309607",
"110111601403662786138931812398206680516",
"156415189788446967557805847297882099586",
"201473658986729545135508816026288167087"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-c7840414",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"33751207731177279916778847055267313217",
"227133732382369820561550942476389327373",
"85372190767816552678888493140283774602"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-c7ad7e9f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/7e3951a1ef87880b6994dc69966c5969dd730c8a",
"target": {
"file": "vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/test/java/com/vaadin/flow/component/spreadsheet/tests/LockedCellValueTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121197145329376912083425646820988589471",
"length": 107
},
"id": "CVE-2026-93547-ceac5666",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java",
"function": "onSetEnabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192923233484013268518831943021142354284",
"157876665848436088383765916788720493587",
"55824247868731363346765442643881428274",
"335767160086616160531986363660508886149"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-d10a1ac6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioGroup.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "89590505678001962171649155691520374787",
"length": 53
},
"id": "CVE-2026-93547-d12f6b4c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java",
"function": "setup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"260747726235634794993902707479722896541",
"274803150691726496786879479267409702927",
"254889689084794453491094603592138581027",
"261080555089734841723742780926909350014",
"167196598393875690145642349052954543126",
"129034739790214737723583443118181997222",
"138704386736152255969783093637196845325"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-d50a2f7b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/GeneratedVaadinRichTextEditor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184820732948850618140671532857375926357",
"270109894138226848586803395009304662431",
"254284928612152137228660671993137850075",
"228042695521773983100669147966890801639",
"237985893107015460913338252594878977361",
"8707089422255774151057341133518027958",
"160675206649894703226676680386500833910"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-d80cf431",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"147669706542717616439282489690739247534",
"174352132234405669341520822581396995963",
"144041428412646472414677686290797476085",
"91678603034938714167609422266820857069",
"175482217806722228465822415951516733884",
"278989618549371147626777820408916959827",
"61900266636437648613916898349232198225"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-dc0db0d6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/GeneratedVaadinContextMenu.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192296712265805911827465241878700714450",
"85160900996113503128956864962449100955",
"123033110637364046102402564600393040007",
"14724920941767003978379020292356879963",
"328168190565018123612562488294530931178",
"252822266523987084777592728934114258675",
"99509896750817620317110092883861233837",
"139430338815560722677403032253587117292",
"89682221290037726859613428174823396368",
"265587249170633488161134699313542747946",
"183342365252072769986093456072442539639"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-e1d50fb5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"236365180443322534775786162807195468276",
"73881263462528490227162792187723418805",
"335050402150907510262695574844648875798",
"76039225499072543023272505724714802083",
"211426072065987685837483016118859488123",
"333048899618785237785388157062487563456",
"307531424693958850275883946342086837797"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-e8dcbcd7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUpload.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"248330057012495454487572247953246174461",
"180204442388735139397723466421837262401",
"297080339719520426227060288276558130611",
"306303978961281584570462686019620492582"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-ecc391cc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"12448788347901060262680827741367619739",
"18698722509563948865487027471465110243",
"250584031738477184849124641692573647288",
"35449937819355197211247567518570563980",
"314800432085723460941030117780871019998",
"111597249665721741040264613142628794680",
"270926575980090071813408269729816966497"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-f2cd9c6e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "289850733904819289915873124456125618015",
"length": 127
},
"id": "CVE-2026-93547-f3a90ee6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18",
"target": {
"file": "vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java",
"function": "setEnabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240382149252733595752779577296411855969",
"101772293080948172956170602989154569763",
"135227480374018299140246201256205472469",
"197828055984619559121822908012482629926",
"107615839872240406063989613637478037708",
"113496577171116847709610927543347904960",
"55989134884685624414937857417269361306"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-f41d784f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308665252251722873145388895931131189129",
"186037273815994831668880381707926035942",
"126263078102742853744189393412346687853",
"273309716519723668405782285685164996321",
"134186575095070449518200754652098371651",
"231592589758450559982797079486843689318",
"263600285041018052271331378962137191860"
],
"threshold": 0.9
},
"id": "CVE-2026-93547-f63daa53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74",
"target": {
"file": "vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"
}
}
]
vanir_signatures_modified
"2026-10-02T08:13:40Z"