{"id":"CVE-2026-91860","summary":"Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge","details":"A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.0.0 - 23.6.13\nVaadin 24.0.0 - 24.9.20\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.21\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.0.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-core 24.7.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin-core 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-core 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-core 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 \u003e=25.2.7\n\nnpm packages\nnpm package Vulnerable versions Fixed version\n@vaadin/charts 23.0.0 - 23.6.4 \u003e=23.6.5\n@vaadin/charts 24.0.0 - 24.9.17 \u003e=24.9.18\n@vaadin/charts 24.10.0 - 24.10.4 \u003e=24.10.5\n@vaadin/charts 25.0.0 - 25.1.11 \u003e=25.1.12\n@vaadin/charts 25.2.0 - 25.2.8 \u003e=25.2.9\n@vaadin/component-base 24.7.0 - 24.9.17 \u003e=24.9.18\n@vaadin/component-base 24.10.0 - 24.10.4 \u003e=24.10.5\n@vaadin/component-base 25.0.0 - 25.1.11 \u003e=25.1.12\n@vaadin/component-base 25.2.0 - 25.2.8 \u003e=25.2.9","modified":"2026-10-02T08:13:41.104971Z","published":"2026-09-30T13:13:05.996Z","database_specific":{"cna_assigner":"Vaadin","cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91860.json"},"references":[{"type":"WEB","url":"https://registry.npmjs.org"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"WEB","url":"https://vaadin.com/security/cve-2026-91860"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91860.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91860"},{"type":"FIX","url":"https://github.com/vaadin/web-components/pull/12483"},{"type":"FIX","url":"https://github.com/vaadin/web-components/pull/12492"},{"type":"FIX","url":"https://github.com/vaadin/web-components/pull/12493"},{"type":"FIX","url":"https://github.com/vaadin/web-components/pull/12494"},{"type":"FIX","url":"https://github.com/vaadin/web-components/pull/12496"},{"type":"FIX","url":"https://github.com/vaadin/web-components/pull/12559"},{"type":"PACKAGE","url":"https://github.com/vaadin/flow-components"},{"type":"PACKAGE","url":"https://github.com/vaadin/platform"},{"type":"PACKAGE","url":"https://github.com/vaadin/web-components"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vaadin/flow-components","events":[{"introduced":"fb38129cc7d03bb179e626e551fa140c7fc77547"},{"fixed":"41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"fixed":"4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b"},{"introduced":"f86528dc71f22a535a8172fafca6fe128d3b89da"},{"fixed":"dd82b58074a82a1c6b3edc050f00007de4334dee"},{"fixed":"1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"introduced":"ffc51a5b98b21f3a15191039050e9d8a8bf464cf"},{"fixed":"b2210855d02d7e09d2e4c2b27bfe4f3f0ce99ae3"},{"fixed":"b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"introduced":"2099b3c966835d8e2677c1d638bc3624ebbb8c87"},{"fixed":"47cf689e61827dc711be69dba6a9d8d04b74a375"},{"introduced":"2aa7290bdb7e8bff78ec91334627c2ed852539dc"},{"fixed":"8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18"},{"fixed":"f42344f998e577828f5876e90913dc8295eee498"},{"introduced":"3eaf3030b40f0cf19230b46d1895e124f742c45b"},{"fixed":"dd82b58074a82a1c6b3edc050f00007de4334dee"},{"fixed":"1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"23.0.0"},{"fixed":"23.6.14"},{"fixed":"23.6.5"},{"introduced":"24.0.0"},{"fixed":"24.9.21"},{"fixed":"24.9.18"},{"introduced":"24.10.0"},{"fixed":"24.10.10"},{"fixed":"24.10.5"},{"introduced":"25.0.0"},{"fixed":"25.1.12"},{"introduced":"25.2.0"},{"fixed":"25.2.7"},{"fixed":"25.2.9"},{"introduced":"24.7.0"}]}}],"versions":["25.2.8","untagged-26dc4b35303a1c4b0165","25.2.7","24.9.20","23.6.13","24.10.9","23.6.12","23.6.11","25.2.6","25.1.11","24.9.19","25.1.10","25.2.5","25.2.4","24.10.8","25.2.3","25.2.2","23.6.10","25.1.9","25.2.1","25.2.0","25.1.8","24.9.18","24.10.7","25.1.7","24.10.6","25.1.6","24.9.17","24.9.16","24.10.5","24.10.4","24.10.3","25.1.5","25.1.4","24.9.15","24.10.2","25.1.3","25.1.2","24.9.14","24.10.1","24.10.0","25.1.1","23.6.9","25.1.0","25.1.0-rc2","25.1.0-rc1","25.1.0-beta3","23.6.8","24.9.13","25.1.0-beta2","25.1.0-beta1","25.1.0-alpha11","25.1.0-alpha10","24.9.12","25.1.0-alpha9","25.1.0-alpha8","25.1.0-alpha7","24.9.11","25.1.0-alpha6","25.1.0-alpha5","25.1.0-alpha4","24.9.10","25.1.0-alpha3","25.1.0-alpha2","23.6.7","23.6.6","25.1.0-alpha1","24.9.9","24.9.8","24.9.7","23.6.5","25.0.0-rc1","25.0.0-beta9","25.0.0-beta8","24.9.6","25.0.0-beta7","25.0.0-beta6","24.9.5","23.6.4","25.0.0-beta5","25.0.0-beta4","25.0.0-beta3","24.9.4","24.9.3","25.0.0-beta2","25.0.0-beta1","25.0.0-alpha14","25.0.0-alpha13","24.9.2","25.0.0-alpha12","24.9.1","25.0.0-alpha11","25.0.0-alpha10","24.9.0","24.9.0-rc2","24.9.0-rc1","24.9.0-beta3","23.6.3","25.0.0-alpha9","25.0.0-alpha8","24.9.0-beta2","24.9.0-beta1","24.9.0-alpha7","25.0.0-alpha7","25.0.0-alpha6","24.9.0-alpha6","23.6.2","23.6.1","24.9.0-alpha5","25.0.0-alpha5","24.9.0-alpha4","25.0.0-alpha4","24.9.0-alpha3","25.0.0-alpha3","24.9.0-alpha2","25.0.0-alpha2","25.0.0-alpha1","24.9.0-alpha1","24.8.0","24.8.0.rc2","24.8.0.rc1","24.8.0.beta3","23.6.0","24.8.0.beta2","24.8.0.beta1","24.8.0.alpha8","23.5.17","23.5.16","23.6.0.alpha1","24.8.0.alpha7","24.8.0.alpha6","24.8.0.alpha5","24.8.0.alpha4","23.5.15","24.8.0.alpha3","24.8.0.alpha2","24.8.0.alpha1","24.7.0.beta1","24.7.0.alpha12","24.7.0.alpha11","24.7.0.alpha10","24.7.0.alpha9","24.7.0.alpha8","24.7.0.alpha7","24.7.0.alpha6","24.7.0.alpha5","24.7.0.alpha4","24.7.0.alpha3","23.5.14","24.7.0.alpha2","24.7.0.alpha1","23.5.13","24.6.0.beta3","23.5.12","24.6.0.beta2","23.5.11","23.5.10","24.6.0.beta1","24.6.0.alpha4","24.6.0.alpha3","23.5.9","23.5.8","24.6.0.alpha2","24.6.0.alpha1","24.5.0.rc1","24.5.0.beta6","23.5.7","24.5.0.beta5","24.5.0.beta4","24.5.0.beta3","24.5.0.beta2","23.5.6","23.5.5","24.5.0.beta1","24.5.0.alpha17","24.5.0.alpha16","24.5.0.alpha15","24.5.0.alpha14","24.5.0.alpha13","24.5.0.alpha12","24.5.0.alpha11","23.5.4","24.5.0.alpha10","24.5.0.alpha9","23.5.3","24.5.0.alpha8","24.5.0.alpha7","24.5.0.alpha6","24.5.0.alpha5","23.5.2","24.5.0.alpha4","24.5.0.alpha3","23.5.1","24.5.0.alpha2","24.5.0.alpha1","24.4.0.beta1","24.4.0.alpha25","24.4.0.alpha24","24.4.0.alpha23","24.4.0.alpha22","23.5.0","23.5.0.alpha1","24.4.0.alpha21","24.4.0.alpha20","24.4.0.alpha19","24.4.0.alpha18","24.4.0.alpha17","24.4.0.alpha16","24.4.0.alpha15","24.4.0.alpha14","24.4.0.alpha13","24.4.0.alpha11","23.4.0","24.4.0.alpha10","24.4.0.alpha9","23.4.0.beta1","24.4.0.alpha8","24.4.0.alpha7","24.4.0.alpha6","24.4.0.alpha5","24.4.0.alpha4","24.4.0.alpha3","23.4.0.alpha2","24.4.0.alpha2","24.4.0.alpha1","23.4.0.alpha1","24.3.0","24.3.0.rc1","24.3.0.beta1","24.3.0.alpha6","24.3.0.alpha5","24.3.0.alpha4","24.3.0.alpha3","24.3.0.alpha2","24.3.0.alpha1","23.3.26","23.3.25","23.3.24","24.2.0.alpha11","23.3.23","23.3.22","24.2.0.alpha10","24.2.0.alpha9","23.3.21","23.3.20","24.2.0.alpha8","24.2.0.alpha7","24.2.0.alpha6","24.2.0.alpha5","23.3.19","23.3.18","24.2.0.alpha4","23.3.17","24.2.0.alpha3","23.3.16","24.2.0.alpha2","23.3.15","24.2.0.alpha1","23.3.14","23.3.13","24.1.0.beta1","24.1.0.alpha6","24.1.0.alpha5","23.3.12","24.1.0.alpha4","23.3.11","23.3.10","24.1.0.alpha3","24.1.0.alpha2","23.3.9","24.1.0.alpha1","23.3.8","23.3.7","23.3.6","24.0.0.beta1","24.0.0.alpha10","23.3.5","23.3.4","24.0.0.alpha9","23.3.3","24.0.0.alpha8","24.0.0.alpha7","23.3.2","23.3.1","23.3.0","24.0.0.alpha6","23.3.0.rc1","23.3.0.beta2","24.0.0.alpha5","23.3.0.beta1","23.3.0.alpha3","24.0.0.alpha4","24.0.0.alpha3","23.3.0.alpha2","24.0.0.alpha2","24.0.0.alpha1","23.3.0.alpha1","23.2.0","23.2.0.rc1","23.2.0.beta4","23.2.0.beta3","23.2.0.beta2","23.2.0.beta1","23.2.0.alpha3","23.2.0.alpha2","23.2.0.alpha1","23.1.0.beta1","23.1.0.alpha4","23.1.0.alpha3","23.1.0.alpha2","23.1.0.alpha1","23.0.0"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["150022249978387135335898648031466430231","47654431071345599032191180474923954650","11954607603114532691911732457153134501","117475445572161072163554277014343517892"],"threshold":0.9},"id":"CVE-2026-91860-00a42fcd","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"}},{"deprecated":false,"digest":{"line_hashes":["139804014910014082595759955460233770290","157644513574755650845569825419532975039","13232134451527595369833234952243738595","336566875528174846137098077993175895057","43994750812215959662748770726165405120","85708241196083166070456182395835209029","224919112073548207090173162186740444094","327773519430404555652577262843872459845","55565235568084177155465310458437786532"],"threshold":0.9},"id":"CVE-2026-91860-01190b12","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"}},{"digest":{"line_hashes":["165820063253606028607994999780872241174","142801850801475462271840188867743544867","313984569223613716081770794911704271602","327682701952160244489994657170830885082"],"threshold":0.9},"id":"CVE-2026-91860-01fa484e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["80022704968395983671319834368854528852","329578008055425389530341520384079984482","206203954687464450569954600977164912444","97853516349101397292329081633705475928","192723554122292508452562176713328239738"],"threshold":0.9},"id":"CVE-2026-91860-0727b513","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"}},{"deprecated":false,"digest":{"line_hashes":["71460354054508795671266948633541700891","212559859979822323143054233100810662537","198783545751491051215205552533867115655","23325114055774291952210179534014219362","88348512905416377191899307033639078227","34922562359570007190932062577357010174"],"threshold":0.9},"id":"CVE-2026-91860-0817dccd","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextArea.java"}},{"target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"},"deprecated":false,"digest":{"line_hashes":["43510491227183790451322630924295846261","275312833198246850961003269078561136624","67295578828912037526655496466693582571","184082853300383203704105311043223456386"],"threshold":0.9},"id":"CVE-2026-91860-0941bbb3","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"},"deprecated":false,"digest":{"line_hashes":["253406546756162198368367828773427419822","57695028920575890088265048630996569216","278030889699741896323279545368927911872","103504452930855624879232182794578427522","296243977377967769575063308015454401832","259082456681319694428215104373556283358"],"threshold":0.9},"id":"CVE-2026-91860-0b11e718","signature_type":"Line"},{"digest":{"line_hashes":["338423057476371269078346580068761667516","165218624906225168839534597767385959035","89250510285310133884588160103397322033","136811365316337125176810354206658066049"],"threshold":0.9},"id":"CVE-2026-91860-0b5ce31a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"},"deprecated":false},{"id":"CVE-2026-91860-0c1b3b35","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"},"deprecated":false,"digest":{"line_hashes":["181998991391930795137156905174572364027","313452702496745268026669533025368447274","273308196773801244355946784790390957871","273326547663240052817239981460802696126","244659612520530119270112738510282029586"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["118158153763717151620121092253483548206","69279852248354485969350712832005945457","106220822277497594210889463452331274623","289798225587666472520324068090394052637"],"threshold":0.9},"id":"CVE-2026-91860-0e4d3142","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/AbstractIcon.java"}},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/DecimalRangeSlider.java"},"deprecated":false,"digest":{"line_hashes":["161677153603347922741052097420041462680","36218417875482553913582419300779387570","61696775185337241996735601161199588227","246957671553949190126326930106307137813"],"threshold":0.9},"id":"CVE-2026-91860-0f6c99d7","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/GeneratedVaadinSplitLayout.java"},"deprecated":false,"digest":{"line_hashes":["337639349341496073403452413997753134055","182136995672750404607740388441871829705","197183611667140176443676879901914426301","64841229518222474182086907596992935989"],"threshold":0.9},"id":"CVE-2026-91860-10109631"},{"deprecated":false,"digest":{"line_hashes":["84580926978750649462666856580505288525","20950155072846833874090302653123654984","47323013180422026042497872102957335062","317917217584327708549344911359963129598"],"threshold":0.9},"id":"CVE-2026-91860-10da3114","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"}},{"target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/Upload.java"},"deprecated":false,"digest":{"line_hashes":["182664332374397241867560437953609303411","284417103751131937565776830301772708372","219168464341844705548978465947213811780","40759398084498905414866955988205674767","115095400695661194487277946195219592839","53098429022801449403586801694792039795"],"threshold":0.9},"id":"CVE-2026-91860-1107b13a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"id":"CVE-2026-91860-11a122d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"},"deprecated":false,"digest":{"line_hashes":["59835666500063819348493083385682773742","316862432427283741132636427359468679092","63234064922750047819109499817100995315","28697633963664451753992133865727417616","338845259220215469016309567234184766058","171072815716129496670032443756309909938"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["64045124586473418993041872196765760319","308804806241151468289307997172361938751","247198805478875923307778728005517095299","186734422492525047252513442279965703950"],"threshold":0.9},"id":"CVE-2026-91860-122bd724","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"}},{"target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"},"deprecated":false,"digest":{"line_hashes":["167330863073057058851130656057846893984","246476471698108910922706156306352690968","212763058532742028530294085087274154624","80202939457722903529363759898306138971","272792247532658863933462844688520776911","177521574050509134662106393874813646090","154957769549024820487642560249913686243","238465965534242829011023792590122509950","9268348415452416658221667503415680913","130298711769705167609094959068571297594","13279292169896571158431860351375125138"],"threshold":0.9},"id":"CVE-2026-91860-123df95f","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"digest":{"threshold":0.9,"line_hashes":["151574430330520200132141933431172668062","31579161866500627277014733776285452892","220834342989198654823091587685915705944","77612431568419700513386035143835888058","37327474320808198522047499437812267435","125850619477790859631753415903401422193"]},"id":"CVE-2026-91860-12af8be5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"},"deprecated":false},{"digest":{"line_hashes":["290792815840682295906563341758010920","82290490233510919299215528415099811812","95424981233633010694529324827624323394","54808891171187030445149481047751445387"],"threshold":0.9},"id":"CVE-2026-91860-134bf3df","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["11926996932901548406771578386876292593","219471549892987520333288078632757079546","218847027540348572831367480208694293592","161137083081090691540376690829134892574"]},"id":"CVE-2026-91860-13c71a50","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"},"deprecated":false,"digest":{"line_hashes":["339862003335662628973170513874122773771","65974874190256354269869374079200770034","43303751817703708085148604350091947621","77777718497245171770307129460114221876","129115829852268885374450744728054773216","236803956365960994462224245288448846588"],"threshold":0.9},"id":"CVE-2026-91860-147c05f5","signature_type":"Line"},{"id":"CVE-2026-91860-14a79e3b","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/NumberField.java"},"deprecated":false,"digest":{"line_hashes":["239525793681564293513698642042226958150","7651342984729899757691981719206070964","323798340691999263489291616077282080430","81184826637468337033831069936029790251"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["161677153603347922741052097420041462680","36218417875482553913582419300779387570","235959004905403814279835967529721117565","18912345717246113205765547770217184587"],"threshold":0.9},"id":"CVE-2026-91860-14df38e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/IntegerRangeSlider.java"}},{"id":"CVE-2026-91860-152cca55","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tab.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["56528393212658678200357430461568690750","324075617448848753566477608573837291364","200843875323321980930896694717297892675","39308274493520037554703009470552368722","8775204585280572315364958627552987375","222839493919783777057687548430101822690","324368604219661060216728563426716179986"]}},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNav.java"},"deprecated":false,"digest":{"line_hashes":["217985803823550250262794179442048983042","29962460864819356945458102557563077090","80949025269625932955609311847156798092","316726975983332198531091345779308463265"],"threshold":0.9},"id":"CVE-2026-91860-16a92574","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-16b4b062","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"},"deprecated":false,"digest":{"line_hashes":["288807544109764305603697632221890652535","87669936466187709514147407089959997451","176873081771583475227713670220193740817","283938057880133635805696002835834229712","155870715150561246077195289032981572172"],"threshold":0.9}},{"target":{"file":"vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNav.java"},"deprecated":false,"digest":{"line_hashes":["261578446164430340313240255797147166599","191301381455674724605276141657358555491","162933372276523216620366521678832224057","279393638319446049418654063442491649035"],"threshold":0.9},"id":"CVE-2026-91860-1719030a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"digest":{"threshold":0.9,"line_hashes":["256823623620771854010867491336891532864","225964247291003487401912999995532053015","120428253622282011341788917383428609043","232898596033419302905279561903681822976"]},"id":"CVE-2026-91860-1721dacf","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinEmailField.java"},"deprecated":false,"digest":{"line_hashes":["264886082386068594597620973772576322653","339552908121151548546411364592179598734","316468174699773892762939957988915546083","270347554342506327407917489379903211551","299873406723067243495889307874406772659","253071116440112744627798904430161236320","209316402439564089791189399690490103587"],"threshold":0.9},"id":"CVE-2026-91860-173a2bfe"},{"digest":{"line_hashes":["154483344855470361101684865004681358524","174103306002219151443859860370989806368","312457648539658348600017182369750410711","293212375484810887310512357454700064359","164616533515069105088821287476049377915","97904507079693366878464439040570795491"],"threshold":0.9},"id":"CVE-2026-91860-17581871","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/CheckboxGroup.java"},"deprecated":false},{"id":"CVE-2026-91860-17cfde08","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"},"deprecated":false,"digest":{"line_hashes":["318614899385403132639030391167910881223","169678073742986384507657576041428744923","269211986485941517985611465237138040929","56797995078007786366415582986982827879","157030477821597815681373676597042586221","134722098292300047869760730266290002417"],"threshold":0.9}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["162650051005338802484790117605269492564","253043602754952450580769775376977378134","35184461021558634366740274892738436889","339743292116345604460589772573233723959"]},"id":"CVE-2026-91860-1804ef77","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"}},{"digest":{"line_hashes":["35264786871184202344822324839986302102","96431302827720461442343008439201716264","105717481411262094562281211651049672637","106301667041827920658490742295443036562"],"threshold":0.9},"id":"CVE-2026-91860-180aec42","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"},"deprecated":false,"digest":{"line_hashes":["65261207034701126607483489281406270662","14544999484550580017910451622633443926","331844193854727060947042346539745283940","253611163241845551610714254604715099783"],"threshold":0.9},"id":"CVE-2026-91860-18fa0bd8"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNavItem.java"},"deprecated":false,"digest":{"line_hashes":["86793219918310560448036629292771366698","12138183376824227385729191507162399094","137828277845128724008431192982685073842","28534598826685830690112599163459512988"],"threshold":0.9},"id":"CVE-2026-91860-19b34f10","signature_type":"Line"},{"target":{"file":"vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"},"deprecated":false,"digest":{"line_hashes":["226718785279738169227864701510778095580","101124390178524459373447064230432030573","67873178327611045266091594984982033959","215616079332197731098993670623754149511"],"threshold":0.9},"id":"CVE-2026-91860-19e3fcc0","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"target":{"file":"vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/DatePicker.java"},"deprecated":false,"digest":{"line_hashes":["79007600610408403369851045363049049629","337728120622393100832784758805682034557","300505273375851705722815066603747794590","66552036661751155077823502260530113463","199911446704891838224248183126227650258","5554345148795356092126872317329168629"],"threshold":0.9},"id":"CVE-2026-91860-1bb8687d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/Dashboard.java"},"deprecated":false,"digest":{"line_hashes":["59636054818889035798626413970676301140","200197387999594121432300826620942343519","119272003430707712509225780878519567689","114951224209523306022245448321901229813","92849291564888292873221768494593741099","202248771337412680632312486228347915505","294713403702532653575331772384905182901","176015520490470973349035946791510781687"],"threshold":0.9},"id":"CVE-2026-91860-1c83f63b","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/PasswordField.java"},"deprecated":false,"digest":{"line_hashes":["143396411228304353806050147512067867775","263462391014071658266098368219621197022","170412936720389661037341764768176488158","136631493638403512968575615944578182434","160799116235950639922621058261226495421","130785252530047711336345947257209726016"],"threshold":0.9},"id":"CVE-2026-91860-1cace1fb","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/Notification.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["339849631427831223049978429670670751510","282319451311979212491530436234115681508","332748708974976255938609480860436128972","256535561965279729913366871614464593719","151090803441256613225818081668038784756","154473218616479039986315278420729779793"]},"id":"CVE-2026-91860-1d26ee92","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-1d345d98","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"},"deprecated":false,"digest":{"line_hashes":["677117734493331432316145911839233197","160213264377640838067153238700837890490","328461641808303605742920323737810081743","284965866372647701917069165497983973834","188663203908123076233390873269441551587","309847126066467301921684163740419395755","258653698138359134022654877744521040729"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["173937063169944159206362820498810695186","314256316346125263850957957481329931465","101831196918575528116593562589560141131","188337080513462347375032712572409917145","73099137799210703574303899403707165756","283311207175205736087148673442877418692"],"threshold":0.9},"id":"CVE-2026-91860-1e1dfadf","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"}},{"deprecated":false,"digest":{"line_hashes":["314927501927776749997706372686884295090","130225475764449037356205531235331989557","144418911608124792523389788076103810052","224651553153346152351499138681149182559"],"threshold":0.9},"id":"CVE-2026-91860-1f7040e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"}},{"deprecated":false,"digest":{"line_hashes":["286095164987287837384579148483935314124","308825750001532296281596111732817448698","126195899400981515693710742725145711360","167635803900787829981391247485392848063"],"threshold":0.9},"id":"CVE-2026-91860-1fccb2c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"}},{"target":{"file":"vaadin-card-flow-parent/vaadin-card-flow/src/main/java/com/vaadin/flow/component/card/Card.java"},"deprecated":false,"digest":{"line_hashes":["52419679252482610457774442373676683118","165960436685952156218388484770446777996","265131620754932431503465102727009262891","168896713767143756737954853443544663314","129180324961494164483239205328175025047","240096638662798319750936881912569653680"],"threshold":0.9},"id":"CVE-2026-91860-2000f372","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"digest":{"line_hashes":["339358128199368660449303409421260137716","50859895656435089643606463987027579135","85200415459428684127076359124480213873","121086627409195035758333466384665493163","196459052972410184312324334850447117093","146569395576243949732748963256078066650","188656282883376723791402694916328283116"],"threshold":0.9},"id":"CVE-2026-91860-208e7a58","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormLayout.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["191808895912370347516695747938319400166","278464140399482312505247196505016597059","37831724787940896097335978412173181952","228042695521773983100669147966890801639","175791325826089812110533623204205660138","289634322657346398850163851324953878559","186806798073385807651842146375817809752"]},"id":"CVE-2026-91860-2096dbf0","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/GeneratedVaadinDatePicker.java"},"deprecated":false,"digest":{"line_hashes":["176462570933424815658047137258311676296","11804231312275787404598469476240772286","237064518287325444808860864105251146283","12113835077192690950412275839293301343","227143884354788317902376880792080660055","331729605430946958981696168837120931667","68203389204870834201746409303363081660"],"threshold":0.9},"id":"CVE-2026-91860-20ec64d1","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"},"deprecated":false,"digest":{"line_hashes":["230201620301265729287914823947106160922","289176930279900928222905526584305520651","171936610336888225332370714467666056963","317620444147960626850157651254516070947","255295401366700735586270104737784854054","35851375399594577352904787856160954472","339763955514387121919146246012918468799","288247635986409384575653099418480543391"],"threshold":0.9},"id":"CVE-2026-91860-2142c154","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"},"deprecated":false,"digest":{"line_hashes":["172105510792551928896217968902641556294","264574445747005778674097369856079708342","45588210604556331075443307514444178826","88174851034939858682824867459482268246"],"threshold":0.9},"id":"CVE-2026-91860-221e736a","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadFileList.java"},"deprecated":false,"digest":{"line_hashes":["146426771534662590945852843454755018496","75879011513790196965782003493366789123","165594620557765425912316435700741975815","50591926597613146886408324650627911718"],"threshold":0.9},"id":"CVE-2026-91860-22604d2b","signature_type":"Line"},{"id":"CVE-2026-91860-228d412a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadDropZone.java"},"deprecated":false,"digest":{"line_hashes":["81337121501896101820178096669262208472","184205723005612453908572540374642500987","167435563806362947074955482526677220146","280008011580558847258969796448226520570"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["187878492917358939303207349002436227632","65183619752008960595600515257969025756","175348754033651330298254900868356312679","217492588439935987009082552984441764973","122931687290364272819553630118007984411","5266620351163651567050367023060434760","114360412769718866045781607393166974270","232090047897335170397444635575195210234","240218483270638901428053521174419739162","245107801072664225405818235226806557965","90637910651623701523977683918065105063"],"threshold":0.9},"id":"CVE-2026-91860-22c795a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java"}},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"},"deprecated":false,"digest":{"line_hashes":["319335563772636922441838168443882415880","191962149090652637672230472863835465396","273814512111863790569336450491072506349","210181994341964362488474114937120362408","311035585269293114669641902533751291582","239773814596530463941231860871776105213","129150706120547662184561353077942454000"],"threshold":0.9},"id":"CVE-2026-91860-22d5fc43","signature_type":"Line","signature_version":"v1"},{"target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/Upload.java"},"deprecated":false,"digest":{"line_hashes":["229575443713150187238803037046781648410","101518327093137825513180139229019078604","252361881394682108049271117757042496895","62733314001898924404383611412107441138"],"threshold":0.9},"id":"CVE-2026-91860-22eca243","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498"},{"id":"CVE-2026-91860-237885fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["191616509673216572170704538104501043884","218449799875624544054012009196360724131","38279662326071326784868277463498755088","169289265298972460231776069724763704857"]}},{"deprecated":false,"digest":{"line_hashes":["314239849463081837626662116026871919866","40819544071635864086280156850796281894","47502861876602863699246286520016984129","277608954575247826530036581401651630528"],"threshold":0.9},"id":"CVE-2026-91860-23b34345","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/DecimalSlider.java"}},{"digest":{"line_hashes":["237182460022269225328930951631950830736","158394785713260049255126793858307372077","221712573213956385580447890331761467183","65187838607299131885624690654495379568"],"threshold":0.9},"id":"CVE-2026-91860-243d31aa","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"},"deprecated":false},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTab.java"},"deprecated":false,"digest":{"line_hashes":["57576137265725683361030683898059436241","9784372319100683215754767622511098744","222370475748735533613936567000048990526","232195050182601260754401940854787409012","188821404639721968343183224743250648857","130881945820937367369054854758540490301","26847135543689638393775422567550366837","239494238228205856391532309480088524931"],"threshold":0.9},"id":"CVE-2026-91860-24ccc3c1","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-25632885","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b","target":{"file":"vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-testbench/src/main/java/com/vaadin/flow/component/spreadsheet/testbench/SpreadsheetElement.java","function":"isInSelection"},"deprecated":false,"digest":{"function_hash":"101277297818572325322835450913156032517","length":344}},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-card-flow-parent/vaadin-card-flow/src/main/java/com/vaadin/flow/component/card/Card.java"},"deprecated":false,"digest":{"line_hashes":["68822094275835951492326558404713793457","328950934253056123061842809123157186838","190900229833919411130840504864411826266","216063143150106557101454488297107298842"],"threshold":0.9},"id":"CVE-2026-91860-26bd84f5","signature_type":"Line","signature_version":"v1"},{"target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"},"deprecated":false,"digest":{"line_hashes":["310723032833634798599800289931119409211","2099159557420148499595097462776673552","20513334240292002585711973050871101636","193806335394942766725414533603392981548"],"threshold":0.9},"id":"CVE-2026-91860-26e7e923","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"deprecated":false,"digest":{"line_hashes":["319886305313204774108013156926536192936","150395070036305921884131467670221598048","102123083932101903230031242085604588729","163032960490188177649277847772543802850"],"threshold":0.9},"id":"CVE-2026-91860-2876c428","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioButton.java"}},{"id":"CVE-2026-91860-294d26fa","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"},"deprecated":false,"digest":{"line_hashes":["46676104213127268638121034995699486852","65872768018066367138274418837473568125","74516928638212288011875236089709824897","122966728784973760618833554131483100686"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70064212409999567691996478128845481316","81429888010311549268959681702428914393","187170614660073231669853299150269403294","87973070905318547203268558341420762516","253702589209127932915004223952254647866","28211092190438673411206876980186956581"]},"id":"CVE-2026-91860-295cc498"},{"deprecated":false,"digest":{"line_hashes":["60363025378711219742842547724063607559","309584335845797394126197783036785504550","268634508645993679992845182965868937623","207418596094996944050788009803680683599","95696025324894524953214672662642746122","146364756731959192057897319229630616731"],"threshold":0.9},"id":"CVE-2026-91860-2b6e07cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/NumberField.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tab.java"},"deprecated":false,"digest":{"line_hashes":["59115855588606287649970956873056037071","59294973266345102400160149946518708927","230810576345641563209457256696384361801","58122651527967169145939033476219424770","65522036032228278526478053256044672099","20342091649349692267695053499351368229","249298486837261640137392691149500393968"],"threshold":0.9},"id":"CVE-2026-91860-2bd1ef8c","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"},"deprecated":false,"digest":{"line_hashes":["254411968841775354545790848483995001644","174924954776553532400443863312738025919","118478396708967026210987655857571948154","311858848155737421822668364988570375868","198530101220163538932302937904422130091","3534784715736654914339283796345001920"],"threshold":0.9},"id":"CVE-2026-91860-2c28e12f","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["163847944614342458294812051159848721823","340119597554805214031817451644806810853","135489395178113990714558129096458767502","145831029491862655494979760803292056635"],"threshold":0.9},"id":"CVE-2026-91860-2c351c29","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/NumberField.java"},"deprecated":false,"digest":{"line_hashes":["287240877486007018058517037253441486955","151432024311051203430075384205300972102","53877941281262083214868764019400575286","47589444521178565735032653989317397422","278835055807670583796575774117605933441","175435788758679859197709727631261733492"],"threshold":0.9},"id":"CVE-2026-91860-2d7ce5a7"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"},"deprecated":false,"digest":{"line_hashes":["192329059073254750513606212101221384874","180943010683760263249829063912135678243","286144022943891506348121275733162456302","13725363218405470351618312454205006276","185215940862580526478630502726523784894","109968381096612378234786252127608400331","306905642126268387175527923967933992030"],"threshold":0.9},"id":"CVE-2026-91860-2e425f8d"},{"digest":{"line_hashes":["19496180787552983424536195175335494004","292382145854007549342876382309433698662","304955333998070277895377251333488285509","72247719429583895431012429309008218215"],"threshold":0.9},"id":"CVE-2026-91860-2e8f027a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["283109948442922334697617923763787179641","328053159679619351604700774932371521981","224813297463884249916918688350377488118","297831502076321753290534872704633287417","139796755965455753218577141503206287082","136064380819477237718606767057061480890","336656691377228058967625245756260033136"]},"id":"CVE-2026-91860-2ed9f001","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardWidget.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/CheckboxGroup.java"},"deprecated":false,"digest":{"line_hashes":["100682969109635639814209451039551377352","295034239930127197707877324101452447724","40337487413818703251372455430382612752","190910088224385431237697950746100904643","198095787651347432748322107290854612729","189963982058466762564955494724707293288"],"threshold":0.9},"id":"CVE-2026-91860-2f2b1111","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["298089096182048118300085904107383029544","96388262575904299516900738297195738318","103082004713569729570821990027270337317","138758749581220245255680259923551835818","41193102632859346870643113944897855666","7084706873140500010492591379158392984","233622751301832335211639457853771697757","98697826311452383634708469123906294011"],"threshold":0.9},"id":"CVE-2026-91860-2fd1dc47","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"}},{"deprecated":false,"digest":{"line_hashes":["200538558900701543298409791978784231584","163861171940665120716729070945818019878","182089358515676914311824888440413348093","136392586581598612908418667656955429095"],"threshold":0.9},"id":"CVE-2026-91860-3078d474","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"}},{"id":"CVE-2026-91860-30cda09c","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"},"deprecated":false,"digest":{"line_hashes":["120995776368842841540032495886723208636","97124622675518027156598655268177862697","283309843579607961405796279074403456388","196832386664497373049833293337314416129"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["13063391820631172953904965775403839668","179244571065038283731814233183086828444","223616494693066068673402814056766690650","273963831503250469257988592780068742123"],"threshold":0.9},"id":"CVE-2026-91860-324e8dd6","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tabs.java"}},{"id":"CVE-2026-91860-325d45cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/Checkbox.java"},"deprecated":false,"digest":{"line_hashes":["332187042598988117410858011715268477876","115369977661683595734331105390833352556","216473666264351955095992393626449866086","185197387977402165661259126704707883396"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["191061560613689480253819919839691491464","28531836507086756392153710407978244161","309336307374985114853331499183041592049","269999713227844423592796109285805218844","96138524583551680182539677276971965015","250672098586985031667702795581154987902"],"threshold":0.9},"id":"CVE-2026-91860-342520fc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"}},{"deprecated":false,"digest":{"line_hashes":["115741627196033955352740076878494525557","12090350657536638073904665362396528545","101705517318127877902703184183789934088","152233282415911041010281959552727861777","193456814348297137911212479072491760205","109723050929774491613756726796354669932","33016324394107199248712789547205850548"],"threshold":0.9},"id":"CVE-2026-91860-34f3ae52","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"},"deprecated":false,"digest":{"line_hashes":["243866701728381313738622198332287023276","20874173117945042338402295576203325475","29411668627916835026796721339662665212","53949199179975319570456356017983057039","58763987950122613813479247974005461747","225263457551036152726080429596517156142"],"threshold":0.9},"id":"CVE-2026-91860-35eb9329","signature_type":"Line"},{"digest":{"line_hashes":["182411569621421995898137136551913566683","279946130114317484345431618292651097458","232976732317281311059132867437001706395","103511223650804043332532929290045263380","233831247336527785409047635101447028367"],"threshold":0.9},"id":"CVE-2026-91860-373e4303","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/ContextMenuBase.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["155135688467525068229419652274037937906","78821348138547478635053021461037021442","232748733437646410317386577745908915264","189236337370126497418862688357303214379","172638711363753736835798950410457809067","236658381464253866091405925114434104886","194263834950269861011591660742891466368"],"threshold":0.9},"id":"CVE-2026-91860-383c06bb","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardWidget.java"}},{"digest":{"line_hashes":["198278969368836027180516379064686156695","292475397102988434990519544339967114209","208201998159743364911190285311185476631","55754894210980901923760043823501980011"],"threshold":0.9},"id":"CVE-2026-91860-39d22c0e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"},"deprecated":false},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"},"deprecated":false,"digest":{"line_hashes":["319335563772636922441838168443882415880","191962149090652637672230472863835465396","273814512111863790569336450491072506349","68207926509279664122118898628473381260","187435772876896398444433897018940467589","177931250631534213142782163970362183460","29038517509170570206558330634759579926"],"threshold":0.9},"id":"CVE-2026-91860-3a740919","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"},"deprecated":false,"digest":{"line_hashes":["205886492405740034219645486187046810677","70678179978620260045708873833702871911","320891370851692573346756193065185250383","131505722228998972784114410275912231106"],"threshold":0.9},"id":"CVE-2026-91860-3a93fc80","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"},"deprecated":false,"digest":{"line_hashes":["148894924585365974642268941180823793989","205122796566615840020368803338149832688","4594601767935482560184412717222600337","51636861566931085158666783594938852877","252244327282403336485088762507028891446","31011048963010996575177804786949457232","3739999029154109081550460632421053991","293094725849694205411446862249340624511"],"threshold":0.9},"id":"CVE-2026-91860-3b35e291"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"},"deprecated":false,"digest":{"line_hashes":["44534781375291199580782136191885280440","4437261917412925391878554658654086777","95379092907407715683535410190963722300","154469792574197813733642830177856813398","221712455978723736614517743468350599982","232399090880183909592322498845881773151"],"threshold":0.9},"id":"CVE-2026-91860-3d3b2f89"},{"id":"CVE-2026-91860-3dc25619","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java","function":"setEnabled"},"deprecated":false,"digest":{"function_hash":"94215097563696518968142770020851707059","length":124}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"},"deprecated":false,"digest":{"line_hashes":["284956367072793838560863368648602872311","73926927601138603400947430286159346145","242886474003600155021846837875946191172","70779642465380805707942233979537287285"],"threshold":0.9},"id":"CVE-2026-91860-404e713e","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"},"deprecated":false,"digest":{"line_hashes":["122214457292668270259616897966086856158","284868926174609364283242610964408704958","308579315570955473166196606396787837945","118863128363336726872649250392810598406","157713642203272456630450319704120225619","304954206707355744734948918909963245779","188628152124315505580886960743122661810","263562954493957973610699789735507356530","259532268690019241572784185038585407478","190616727812425483973702406763497022507","140960119378718788711635754128476173336"],"threshold":0.9},"id":"CVE-2026-91860-41805a19","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["288697382611466629320255861159801026000","67843170617113520839887071821451292900","119707762601799422021209512523963706411","102211332704072232455406533706157437126"],"threshold":0.9},"id":"CVE-2026-91860-41d860e4","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"}},{"id":"CVE-2026-91860-42d3163d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"},"deprecated":false,"digest":{"line_hashes":["298681038068353783669040037461577991024","159618791007228107099708471078428002177","43482409582076661932093587706154707690","36786430489340192100807310632607298905","112253298734384870366355456937041087955","339039503525011916525355240557573778233"],"threshold":0.9}},{"digest":{"line_hashes":["125542708423254180184490501726435776211","285326487856755650705580980438075886426","252093910142031954120233202640959430170","145179201001583151611475073460071351655","71044882135712510871477415856482053537","95216166418836703016698099765570302407","199285825967559726837200400213781854275"],"threshold":0.9},"id":"CVE-2026-91860-454d38b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/generated/GeneratedVaadinSelect.java"},"deprecated":false},{"digest":{"line_hashes":["184236262922026496279433832334031982977","131485253675872489743137859007724128444","201561132135111867427906619256639719084","186711090563500187815144970995606008851"],"threshold":0.9},"id":"CVE-2026-91860-4624fc68","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-badge-flow-parent/vaadin-badge-flow/src/main/java/com/vaadin/flow/component/badge/Badge.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-markdown-flow-parent/vaadin-markdown-flow/src/main/java/com/vaadin/flow/component/markdown/Markdown.java"},"deprecated":false,"digest":{"line_hashes":["299623599809392475231361928544625637091","91776709457794079485987557824761172901","271907999530889196917982403954395966928","53502339423995883769046757254510866324","233156435622039246010919824063251107817","3302870043256233924606901775784721522"],"threshold":0.9},"id":"CVE-2026-91860-468c023d","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["109511982655797452939015622368148062683","74218516679440080281267252406700877123","267518687815487679580073047429859636243","92900267606857882623736677957867461971","102087353120615643410056730700579294959","234791744416850508024599488530706104395"],"threshold":0.9},"id":"CVE-2026-91860-46a542d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"}},{"deprecated":false,"digest":{"line_hashes":["185106646767982335649997511782696897303","212432676798402569369029961837092795699","210700442976250407034921625521394528803","161986217768719924419948958414346551472"],"threshold":0.9},"id":"CVE-2026-91860-46cf4434","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/Dialog.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"},"deprecated":false,"digest":{"line_hashes":["165968137833737408160637340064193260666","214569625351503208711812290184090583754","235949935109141752180416121379180788889","91103122562431492031006384456842969936","71309471997345684108042794883609122409","12315998428467556154894715146980870935","96165518297190150486800625269449151755"],"threshold":0.9},"id":"CVE-2026-91860-47c9b081","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["243003439425595897387104480557169101796","208628986090217831119968903738540548616","283330007312915906284973432693769825235","119222423561108384753123788269270559189"],"threshold":0.9},"id":"CVE-2026-91860-48488823","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNav.java"}},{"id":"CVE-2026-91860-4c07bf6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b","target":{"file":"vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-testbench/src/main/java/com/vaadin/flow/component/spreadsheet/testbench/SpreadsheetElement.java","function":"isElementSelected"},"deprecated":false,"digest":{"function_hash":"319212023653206220283449331138288993953","length":238}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"},"deprecated":false,"digest":{"line_hashes":["87927471926570327586706129866231420985","83477091966492858221645024893733687094","213105690240447874751987789138699816256","187921168488348115088329591395103645781","152281197428669212135669824339057691531","87048077321762640088437254243245322978"],"threshold":0.9},"id":"CVE-2026-91860-4c2e4e14","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["29143086595964715638679839335964555436","197484545637239969173300077852872208166","12901518315434289807934191433575620395","256085568011290674787323188557374733153","166584884665947565823818159338178777040"],"threshold":0.9},"id":"CVE-2026-91860-4c325123","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"}},{"id":"CVE-2026-91860-4cda4bf2","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-markdown-flow-parent/vaadin-markdown-flow/src/main/java/com/vaadin/flow/component/markdown/Markdown.java"},"deprecated":false,"digest":{"line_hashes":["155973625857343951946058963937001834685","244871676133739294956219770218191651923","317109608140074587140510011738615554866","402956137859420992496058199306435848"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["15698723147241475930750619660506166978","128555961472113491233200122454670790249","115274807142504644087023868638950057113","277457619339576881844385343413258133001"],"threshold":0.9},"id":"CVE-2026-91860-501651f8","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"}},{"deprecated":false,"digest":{"line_hashes":["161789032417775497927028249718519807782","295188965970819343385963683081255486952","42933334843854916521104866664477727922","3216241012338932786639023110765854070"],"threshold":0.9},"id":"CVE-2026-91860-50bd679f","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"},"deprecated":false,"digest":{"line_hashes":["109099308319594873921528275837220308588","142429247337826247633249731870136759958","233775504849881222799801841540070473483","165119053358499097601623809758969847530","243196388267204202737234894496400276847","89764715898966822222390877389766815997","253855398323365199244936792947038376290","273556940925835595189723640177595251671","115660092913163023514208615922277110685","11494545405891050460251534424069639681","83058234698690279094721657936699160665","157307893810061268982960113253866788728","41321985310312895987871303574956775995","139743062104737638620488794851827925099","78486513658984066616140717383883970104"],"threshold":0.9},"id":"CVE-2026-91860-516a39f5"},{"digest":{"threshold":0.9,"line_hashes":["246015875481931204296256701349457317156","50338354493980513450613778932362888810","38542540292502266785821176074410612612","90536225681265423538999170556534362963","186652229361918700486804721640998271406","89819880862687467879411780731981765370"]},"id":"CVE-2026-91860-51a7436d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/EmailField.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/GeneratedVaadinDialog.java"},"deprecated":false,"digest":{"line_hashes":["300826378304734914384370620371318123410","109355843476382320286417959182311815101","239926748279198558638184990052482578327","29406460051694085704676060758007442464","152546706606826330494638609122572832129","163410448430256130578429428470909854319","193753302363044114337060192692555588050"],"threshold":0.9},"id":"CVE-2026-91860-52fb2146"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"},"deprecated":false,"digest":{"line_hashes":["164533704348853400832432883263824287394","313044704061272424170010982026829011294","340221541720633508064832967694349373360","136679825650411954488784338502231391393","139373270610501959711048931176845048542","299528989631884498948650396462958369917"],"threshold":0.9},"id":"CVE-2026-91860-53ada6a5"},{"id":"CVE-2026-91860-558d3ef9","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"},"deprecated":false,"digest":{"line_hashes":["204712174750791791894296481926590824995","50650082256468644059968368052777405418","283175933641113180328350236492106948538","58936357330732602615564276908650797233","25442829955775751978485294846412194681","182627984277603122234718702030352921073"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"},"deprecated":false,"digest":{"line_hashes":["174935549487082484041772387425930210949","339901688476950347950191275428512624569","60667006300343880581537973784494375672","119046087782027317943977808691790815284","273050958374732210829831961661036284340","14735135444873947301021267859471378952"],"threshold":0.9},"id":"CVE-2026-91860-566caf34","signature_type":"Line"},{"target":{"file":"vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/Dialog.java"},"deprecated":false,"digest":{"line_hashes":["69841822592022145402349033498556052472","51707144573319539687572802807417629373","130837768301543318238599309974784200431","203937132478992112885449817341150594414","216283572204349149770617163243943026529","236838918553408296822469601103971029127"],"threshold":0.9},"id":"CVE-2026-91860-56a204dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"id":"CVE-2026-91860-56e10d35","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"},"deprecated":false,"digest":{"line_hashes":["115932272642902392566299230649185020274","317655542300988685903170852637608072995","43369646329958978481234205284491553443","339275876894944824040302103281663599302"],"threshold":0.9}},{"digest":{"line_hashes":["120767614015157957116832806591258772871","159316906014981805017369374603790611300","272967845450666244248019911106028104115","263228877494902058929860530487322881280"],"threshold":0.9},"id":"CVE-2026-91860-573b2b53","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["208737347097499460649065520147819483112","9887858371098162727385022718867313583","258868636927991030791569444309707069621","198853275657369263780851532599680526042"],"threshold":0.9},"id":"CVE-2026-91860-58776315","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"}},{"deprecated":false,"digest":{"line_hashes":["43168907721496937807060761376284438182","138322767020864317215767040828408154170","172799544826302982077084874429319562754","16750184594322163914510769486499090481","106505701127485929459122114668251633130","259992568681891345952287935380210032176"],"threshold":0.9},"id":"CVE-2026-91860-59600604","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"}},{"id":"CVE-2026-91860-5a743f90","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"},"deprecated":false,"digest":{"line_hashes":["268424382519619221068243805225422369939","176329273338983782513885306095672287091","99835585631660131885254132199032615732","111072382864189789668459439661681623412"],"threshold":0.9}},{"target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardWidget.java"},"deprecated":false,"digest":{"line_hashes":["33965752179760906139177103205278343571","310588763100592834827091584735291253494","303722193600591801922555595504036493472","88156380706443353533511243365776549762"],"threshold":0.9},"id":"CVE-2026-91860-5b0425e1","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["7509650228223745123955093846417153567","20208408537690051594190466668889934156","126906206841940722681101212418595494396","81376961339590630854549931066954948848"]},"id":"CVE-2026-91860-5c06d9c8","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-popover-flow-parent/vaadin-popover-flow/src/main/java/com/vaadin/flow/component/popover/Popover.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["188163430304847106402419393621983642057","294813204071162874034937883330036858590","258127025353727746047976604287580900469","321387867364496169763838590176806469436"]},"id":"CVE-2026-91860-5d165e43"},{"target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"},"deprecated":false,"digest":{"line_hashes":["150519796866952524036360116552890432631","240802955889077688764171411284803721713","251646388857854122909459259245383089700","240816790028212216573871398389064158226"],"threshold":0.9},"id":"CVE-2026-91860-5db6dc40","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"target":{"file":"vaadin-master-detail-layout-flow-parent/vaadin-master-detail-layout-flow/src/main/java/com/vaadin/flow/component/masterdetaillayout/MasterDetailLayout.java"},"deprecated":false,"digest":{"line_hashes":["16254789370448755722369943425960263760","128170299825627541635541604069992576056","293000082674174306409619477272413590966","334567268811864269333043601906117787501","10717530082562116733866717900185443796"],"threshold":0.9},"id":"CVE-2026-91860-5e6e0738","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"target":{"file":"vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"},"deprecated":false,"digest":{"line_hashes":["165842194142105340939541442835414348773","107098799373957471370496027361916408678","232970443216779284884442327201367234416","31523543339164020012623363243185001084"],"threshold":0.9},"id":"CVE-2026-91860-5ea33b3e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498"},{"target":{"file":"vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"},"deprecated":false,"digest":{"line_hashes":["23915464060710696087093548938400709203","296891493060618395130466698131365893180","221679676065858660553951247086586331214","272240179496748985686775716627170322054","252757338102080358672145075646818532343","91569646472235957676549351189222665045","227048749957502766678637860274872565139"],"threshold":0.9},"id":"CVE-2026-91860-5efba4f1","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"digest":{"line_hashes":["325714592229502105765106057893056694461","211594831898298997645976958528284852959","291701945198085101043529254730676827278","52638596657975888205592312732195837540","84387726759769345885064278101183810675","237270723104887642642046240933220876935"],"threshold":0.9},"id":"CVE-2026-91860-5fa6fc25","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"},"deprecated":false},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"},"deprecated":false,"digest":{"line_hashes":["86297538617788835848912872688789953321","64314744928844037843411451827423366288","214465647016627080201805856430274665252","192161380160773546493375836517642912665","285784964176737256010770708083049090472","93445143048318257609861494390362547947"],"threshold":0.9},"id":"CVE-2026-91860-606c319a","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"},"deprecated":false,"digest":{"line_hashes":["195872166064038912416814011074557845593","102694864198822237186884711274208417250","40353231455315680183133332071630342457","143951135370435846800180020269358345920","86592538618473062846915078226153603780","94715695344542986648380569964858077615"],"threshold":0.9},"id":"CVE-2026-91860-61443d77","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/ContextMenuBase.java"},"deprecated":false,"digest":{"line_hashes":["261194203071361036844171277682591862999","146632641186678873229818928951882222458","151231302634578861987264146848149730318","55782839602399776088425081751119704042","15033242662298267173051793511514859601","179977265774384916739625517829791410862"],"threshold":0.9},"id":"CVE-2026-91860-61d035eb","signature_type":"Line","signature_version":"v1"},{"target":{"file":"vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"},"deprecated":false,"digest":{"line_hashes":["331695949661642704054358543676425196993","130082900393848411472914659772066510704","278654718638579125009443920264070020237","103105773234313912841403200130872626900","68680838279358822913179183397277559126","22794154688379504767843814072194529010","243375664151456322202188921250557969544"],"threshold":0.9},"id":"CVE-2026-91860-62f98fe3","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/Notification.java"},"deprecated":false,"digest":{"line_hashes":["9492058904144190462401318803108478148","136441113118671111146403447684565221490","94410663057367313691000613485137356915","125430935359713052196588441594211849121","286623339757839513386709493927026550429","165049308801656684927896637794252904898"],"threshold":0.9},"id":"CVE-2026-91860-6300d222"},{"id":"CVE-2026-91860-64196bb5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"},"deprecated":false,"digest":{"line_hashes":["285299561337708045084141733360397181879","328712877877364299738110475660279280186","226765082156902828799671219370805527776","84228523039162689436281501616357021129"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"},"deprecated":false,"digest":{"line_hashes":["133692119156590038724960648503878388387","128799939694515685140101245758848655362","66895408611146281818575319932888804466","297761285997344584033497421090789238355","91047348625361866104586324859834302900","222640208638284573934082880350817430565","231257574783938170895854250570117476448","193891923162156337782198482712842965396","231641059062251897602530987003028083978","198462424370723068282635268499212359372","213046146385460822868339206060287575225","22908424730610608225943025312239326876"],"threshold":0.9},"id":"CVE-2026-91860-64f780c7","signature_type":"Line"},{"id":"CVE-2026-91860-651c9911","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"},"deprecated":false,"digest":{"line_hashes":["10695398993901130126524256648111426756","71088825340520715117035264342596952622","298121506233416827925719370144078121969","265902173811208154901801579954188507255","79950434984058930922753047753947397395","15525473410893240237817433022336524429","251051406288606960212531596126689067364","142566843632775685958365403892440461981"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/Upload.java"},"deprecated":false,"digest":{"line_hashes":["272445947043007518687477305477329869479","60600229709230289423930932894937581193","223296469431784272874863123042383424449","210404082331664569157739307981984556001","8671091646369936396242548351860070249","140838976918662262142588828794062222888"],"threshold":0.9},"id":"CVE-2026-91860-658a6f18","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"},"deprecated":false,"digest":{"line_hashes":["94932384613816633695496180149607502386","326259052865574321665797409733342735367","103354501524288949954432116897960412590","160834781040322187917445926517488801569"],"threshold":0.9},"id":"CVE-2026-91860-66466507","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-683a3c4d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"},"deprecated":false,"digest":{"line_hashes":["22608943814735554080260452743789021849","255672148858980605281042921763497852876","297307368075890483644630176272712766374","11992029449152443567309608112944314266","303845321096730943506688281587233179176","109383799550672341692102976450407950532","257160395088732415267496068560189532121"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["37954593981273224711651226117012275374","50029570256929089570759330400766271728","49509070851887386787907590323123065782","11992029449152443567309608112944314266","134392995199879721010538339736372947234","88623736752635021964856203766557704040","167635133703589878233420053367415801339"],"threshold":0.9},"id":"CVE-2026-91860-684fa8db","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"}},{"deprecated":false,"digest":{"line_hashes":["288687792673433700348197131593301366820","227481294731255731117075951849040142366","171383274442616444605643400008098622313","110486892725720736657994911124852247826"],"threshold":0.9},"id":"CVE-2026-91860-6bc60953","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadManager.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"},"deprecated":false,"digest":{"line_hashes":["277528017817876802727725325136260185618","176840988565288406166336156846210233369","281584566184203670806375394481570243192","77454217334003516391490276321733626959"],"threshold":0.9},"id":"CVE-2026-91860-6d129ed4"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"},"deprecated":false,"digest":{"line_hashes":["241689171885620782826981589845663004777","299616126575864573876546891671612518081","54830249824303220446958746624092296859","263782993191051094061743760653308064638"],"threshold":0.9},"id":"CVE-2026-91860-6daccd77","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"},"deprecated":false,"digest":{"line_hashes":["17212059509445286379964670667150793504","85717068869346576046281913497764085003","250320678773599102149281490072375231972","53158937159786167420633050912289859020"],"threshold":0.9},"id":"CVE-2026-91860-6e8dbc9c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["246495699286117784876940535996927167370","36322029582246090283878995999200189506","104781442316363996658754814161426595801","110598215805717078279779415929388554796","157713642203272456630450319704120225619","12134746024668202352507960293395126502","320058606233320720295253178081969585030","66457225638123345155072827834297469935","70878197866488802167937304949045691077","303025568116758076427192124058382137415"],"threshold":0.9},"id":"CVE-2026-91860-6edecad5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"},"deprecated":false,"digest":{"line_hashes":["213009417188491791307043362245826794342","182753604209043474200604711505150072076","230907507161339091686735364828898540585","13692868300423321171914222465504622505"],"threshold":0.9},"id":"CVE-2026-91860-6fce9ff4"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/IronIcon.java"},"deprecated":false,"digest":{"line_hashes":["334233500371833792753575364112259844628","284153417450888717578420138615768288735","188485950816725313378128281625837796446","114402648547973463757447937287298547284"],"threshold":0.9},"id":"CVE-2026-91860-6ffc2a03","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"},"deprecated":false,"digest":{"line_hashes":["294314443659328314574063781147987609033","184497596477210097044303804620817361300","91205654088421391358817480570349116215","24856242566569369743684399045216605687","218695919518928119345354988807493610693","298769898696448505585452584922567717363"],"threshold":0.9},"id":"CVE-2026-91860-703676cf","signature_type":"Line"},{"id":"CVE-2026-91860-706b7d72","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"},"deprecated":false,"digest":{"line_hashes":["143027530658372023088229755334480505379","277062982386753469501822314400029559958","7980661278346755451253668923627946156","97185659982981264166042609487890681675","290112551944260181188061900517467724853","163682424446931058655768675477507220723","269909026305062634715610484805272460580"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"},"deprecated":false,"digest":{"line_hashes":["234183088506690694303166601224076625433","225544410550713821855868466431949071835","50124943851605132355968008306493713230","277694019031374263398670218687918785815","37385236458568929460289125423005037820","265401350939266099739239063731935736903"],"threshold":0.9},"id":"CVE-2026-91860-711a8674"},{"target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"},"deprecated":false,"digest":{"line_hashes":["218862919199480754051629337260538835454","124951472782991165983569559182773423930","12404004292233203819400791899139090814","176168551134820289968728650782907125546"],"threshold":0.9},"id":"CVE-2026-91860-723e8ccb","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"},"deprecated":false,"digest":{"line_hashes":["165514547439980300028062992971534138879","197736796814260515462926292968769301795","28567907427771622444594021055117702644","121086627409195035758333466384665493163","100692717951015748919787003728740983249","208842102433802380174781413921072434269","106793714606155189369913400520341547072"],"threshold":0.9},"id":"CVE-2026-91860-72def470","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["9486403756278168829181911628021249626","104356880514060629591554550210751516088","133007495947680000070408269365694609962","12743654030765929263470535305973498692","139196424454802799599119657153757607969","327674210378814045462636197031106408964","256410201959885610488855575299852273346"],"threshold":0.9},"id":"CVE-2026-91860-73018cd9","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"}},{"deprecated":false,"digest":{"line_hashes":["296134014643193894687108216620192861202","150076420155488188747186365406386646575","58308549095909287863561501069992775605","218467119670865233717677283628302079794","91605728170722333859935741182843980187","325101047337923583092387400877391856847","27185662108624818765404783584005661541"],"threshold":0.9},"id":"CVE-2026-91860-7679858d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextField.java"}},{"id":"CVE-2026-91860-79a883ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"},"deprecated":false,"digest":{"line_hashes":["293436043113931556661991005760028454662","235447229653449438895142897430340348379","82651066619456103634628477963619224361","116431308566440759502980775418169177020"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["206620605891499776784643063226886948164","156030796842365566805121611889242939290","45925193147904737269478008098808241387","156420382374552099720260547299012607975"]},"id":"CVE-2026-91860-7a7f42ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/LumoIcon.java"},"deprecated":false},{"id":"CVE-2026-91860-7c066812","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"},"deprecated":false,"digest":{"line_hashes":["143945263087195195433056481264397757373","270753459082211352046272627266038344264","190083653505490176739099851326740872486","114309851045378841944690168680536785152","225803020388371833297188319532595137627","1729832148544909964121999006213758779"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["130020321119585648304602959223018937953","145419976555646725813793441848892554965","72305727064057742973202909915956970373","106866120391306443300106877633896973227"],"threshold":0.9},"id":"CVE-2026-91860-7c63b533","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"}},{"target":{"file":"vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"},"deprecated":false,"digest":{"line_hashes":["225540483090751340113889186684091680886","158690280929840228910283972184184972671","149489179055218984381384723167628830813","53104386335829487354348172393287393433","297746535931736199834954775694367018750","257895823319996181498803808031197966094"],"threshold":0.9},"id":"CVE-2026-91860-7cbc4402","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"},"deprecated":false,"digest":{"line_hashes":["242461987113815059436224261876920864994","58616288638414918022360298820018421596","286230058410876662914872230508195362817","314003210706103683491813105602213624942","195091782348218444133263496554676348800","310982269801446836170220224483744019876"],"threshold":0.9},"id":"CVE-2026-91860-7d6e51db","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"},"deprecated":false,"digest":{"line_hashes":["31037700099059140541680305419453522593","138937999678846696860540119192324993979","59750104353806682566840667148220941246","114166284125066660673694458256931888839"],"threshold":0.9},"id":"CVE-2026-91860-80153141","signature_type":"Line","signature_version":"v1"},{"target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"},"deprecated":false,"digest":{"line_hashes":["192909844326342575930476358813383402930","190796852851426654903390631192665159694","86952591961967838159154087611792472747","221491069540331823576923451771662301382","134202564630436431769670348683638748810","267164055659843323265031284140235744459"],"threshold":0.9},"id":"CVE-2026-91860-8102fa49","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-markdown-flow-parent/vaadin-markdown-flow/src/main/java/com/vaadin/flow/component/markdown/Markdown.java"},"deprecated":false,"digest":{"line_hashes":["100700901744817609794181689536149178239","288090506492172444876757703068805289052","8186000294009409977394771021970617247","84554294403884587699916380107453218325","266968653199521199028925839167009581104","52736570179951010502897544369355381305"],"threshold":0.9},"id":"CVE-2026-91860-813bc713","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextArea.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15316911802207747544311992172040113304","292004762124625875959443494704751598430","119477781839475121223157296765172606589","62689871670929169898403069475800120316","82859937631875715803374124147260715449","209395364945961899673180406834146151382"]},"id":"CVE-2026-91860-817d892e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"},"deprecated":false,"digest":{"line_hashes":["289816378108832693747395344146423737229","261685897857072776751021786120559667931","313338299458204470094747796957812776056","324998533848178408765609434958929749402"],"threshold":0.9},"id":"CVE-2026-91860-82a4201a"},{"deprecated":false,"digest":{"line_hashes":["198647512187499685214880613042387758106","21032544857452856975558220738798765247","49319481243249676713773822152903144416","31222762952286725222602278372113198445","147513196678257908188434477544544196950","244001327660446836958714168002808457491","274840722312985869075649982803895211809","182892724988435501255759983926365202557","37474888515022502532728131506171977668","302227653316512308628960120001890913951","332515598916671325400434797384003480246","219315195384702890339653847086626519552","54956054180153818160320175187228292394","318983410520993044277614759720770880234","72944434445205206427676858270487019129","42614068511606013618242338875671513685","4838823625669271305504437570829113350","46879597844519904515200519902454487083"],"threshold":0.9},"id":"CVE-2026-91860-82dea924","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/FormLayout.java"}},{"source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"},"deprecated":false,"digest":{"line_hashes":["281041278146625037846237307998288270115","96455886673329772949554242428891453743","258806655506500355893160637960825588652","135850451773833390008276204144309570053","131860617791473901849924104194991484323","245565197176910799955030232569448555153"],"threshold":0.9},"id":"CVE-2026-91860-82e4edca","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["163780455284891476353348728803571808626","207003107923825393341936437263634722476","66571163961688925539899958841772730227","173090136893706246406790341047000659172","122003765385291644868845163016085538101","193193835907941882594806923652097626349"]},"id":"CVE-2026-91860-83788efc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"}},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/AbstractIcon.java"},"deprecated":false,"digest":{"line_hashes":["259616495201720087437866816274058275089","200521057745719612628443780901403271093","143313823054256977147879255128417027884","161844718935980922427007755228063449338","224414386535484235082722158657921806006","176661459619587272285881066189885915878"],"threshold":0.9},"id":"CVE-2026-91860-8586fd7a","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-85c5169e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"},"deprecated":false,"digest":{"line_hashes":["223040610374237325027818743355929955062","131066009192597574867696755545880438161","178597332604072057606393046724597848768","211201672180609774870195209014496340893"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"},"deprecated":false,"digest":{"line_hashes":["211718625142959083659010516062488358425","117401814046726618197775161750400511144","139256287925872931606031228103741393289","167438719336612057965373778498193864641","315768386472693748164478083606810582631","109060019357375908852124640024146588505"],"threshold":0.9},"id":"CVE-2026-91860-86324df6","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"},"deprecated":false,"digest":{"line_hashes":["64226170934336236073007597738702317760","207424279715551666644601135288349175006","191537745693800899161546529704068355154","289564311499018879947485301797170874731","66809657976619777237557298512259981855"],"threshold":0.9},"id":"CVE-2026-91860-890ee491","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"},"deprecated":false,"digest":{"line_hashes":["170177601492972031142254973377685755055","336894393230552887673325076094538910172","115145836779381282673348070539918128011","282210364516564480941166080730746167345","66953115293861206819822956391122111361","28308467775159067066658526014428778146"],"threshold":0.9},"id":"CVE-2026-91860-8aa895eb","signature_type":"Line"},{"digest":{"line_hashes":["287186416013572949763105224739891442651","191502664875437273041369946956444100678","235862688173339796275065364958489457899","236089026525151820978041911618386317395","85483642999652078342297647274909358879","165227323230700831177659376166211368268"],"threshold":0.9},"id":"CVE-2026-91860-8b3454aa","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"},"deprecated":false},{"id":"CVE-2026-91860-8b88d8ab","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/FormLayout.java"},"deprecated":false,"digest":{"line_hashes":["153207122623884445047797724091910247953","216721727960725661017942656554715374908","312981624680046901859656947543876699210","264742941078667782852372442425679836220","334248027950794975344092776906003767145","95860418630962260153239021042889717445","323971206125243789982296403605346610575","58646461031110749292119143500843335157","29680548340287104505120825337220360544","36289073821421993263491029901709151598","101772106490337782377827537402774476614","300418299418071681711479770714908312039"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["17139459073066948577597065442463722733","238370078926877545422041364937098904025","242993266706821184277991774083634041766","332292535226721593041079559061372192472","29073209658698636902063524831228222573","7064186056011437102597373108829099942","271167879179362872872949303908286764581"],"threshold":0.9},"id":"CVE-2026-91860-8d23ec31","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"}},{"id":"CVE-2026-91860-8e2b8aa5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"},"deprecated":false,"digest":{"line_hashes":["138398861081424908706042942857777361439","161629079414440565853943164587761245716","124916498853164783907287825534199094782","22620731170674566011206681370407679497","157428713359604502028976071253887385691","327058251699920420489861089927165604404"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["91436520539647052828691984743273971212","74552997467599200024952774955645858197","36762249312816587962413439503377249751","19183890552927045569564296378996439650","112594015300868323150873906028952801648"],"threshold":0.9},"id":"CVE-2026-91860-8f5619df","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"},"deprecated":false,"digest":{"line_hashes":["318169978420655560834861458604140627385","201241979948086642080975612603467551591","289006815259786259767173033557327588764","3035670795667065395203864972851072781","184716445595699671364714982228250106602"],"threshold":0.9},"id":"CVE-2026-91860-8fde8059","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"},"deprecated":false,"digest":{"line_hashes":["175667881125707828122800597656399472032","334387810294794106437670458081783172260","7737267507985098291491303243436102924","36748884427554299075344391692964274506"],"threshold":0.9},"id":"CVE-2026-91860-9058fda9","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["273897097380758717627673208757021885519","174426425397083941624352370773054077637","77702827145574704672186341406438646743","142658506569278602447085121911313067404","219398517610271030083955676145192695699","251963939413601368355105413574192039251"],"threshold":0.9},"id":"CVE-2026-91860-90852b71","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"}},{"digest":{"line_hashes":["72307871886703161904392714791892092136","333613575222032533820164106757021428046","312872950847669951778513129954280004091","293342212780890603916221441823755720758"],"threshold":0.9},"id":"CVE-2026-91860-90c5929f","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"},"deprecated":false},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/EmailField.java"},"deprecated":false,"digest":{"line_hashes":["172259922709106497992383723855710225242","49609173297035156188267319797237144803","78690953418027825220177646906206855161","273768175796495120200017321800539695933"],"threshold":0.9},"id":"CVE-2026-91860-9204d2e1","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextField.java"},"deprecated":false,"digest":{"line_hashes":["217994938692373097733105309720460880879","282112240875589196519345889556431577866","296006313870808539847500464380455576075","258997274089820588223636486033858545967","238057154839703584951216849813020209906","55618603362587405262756623814301413260"],"threshold":0.9},"id":"CVE-2026-91860-922d8e8a"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"},"deprecated":false,"digest":{"line_hashes":["13741248180689557946106214883381041063","40146802486074565853844147879313361774","26547252252825219293406564386550954959","163896346242739205592265607297146750106"],"threshold":0.9},"id":"CVE-2026-91860-92748c71","signature_type":"Line"},{"digest":{"line_hashes":["216300732090117562895032066190750471283","223623679212502705972237032710334370682","201290637399674135506191106937059524138","49076613771828789456059252802804881070","338617588737870113000959695241412883580"],"threshold":0.9},"id":"CVE-2026-91860-9354579a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"},"deprecated":false,"digest":{"line_hashes":["286129081824461912373386685418830838504","122696600537683304201517824359619617954","331499159739763707425498094410591953275","93010352653554887474572428483108300692","296135578515743027946389472736410346002","335302875285392095343386765465369235547","263894116202172533101595019824822189903"],"threshold":0.9},"id":"CVE-2026-91860-937005e9"},{"id":"CVE-2026-91860-93f309b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"},"deprecated":false,"digest":{"line_hashes":["263932228569716878028493654794287555373","251520267803906853601443427278291596190","113351744021313239603160655734773573898","160416262712267843847167610626014510564"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextField.java"},"deprecated":false,"digest":{"line_hashes":["122704781773245698545434446041619243388","209179017803964333571140612309255006566","256893496407683937477881851753446849552","259092040532679597299322434212137024503"],"threshold":0.9},"id":"CVE-2026-91860-95df022d"},{"digest":{"line_hashes":["151861268607778617528442703297741355291","62997444179922146649000533830357941312","41933201836200407367609330097471767646","172001675943777915675869389875081093441","289971105651836865924670331962781488329","194788201666869751516466351063789372735","186998710628045208448839329807664559585"],"threshold":0.9},"id":"CVE-2026-91860-96ceb930","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"},"deprecated":false},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"},"deprecated":false,"digest":{"line_hashes":["53236655905047689743343450916041941390","70463800229370569566016426332751107025","250608411832073748968436975650380128306","226166445819169570206210976910032022997","157713642203272456630450319704120225619","261164977420066113379105787905435915524","232060819630126110476431811137009317002","216482500899341642344781408769874110138","141131548921904255321379476419982221532","302448473363790744640235977691059039680"],"threshold":0.9},"id":"CVE-2026-91860-97611026","signature_type":"Line","signature_version":"v1"},{"target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"},"deprecated":false,"digest":{"line_hashes":["248576065396190347144728238716615547204","33530504603780559933686951533678137431","253259934117684048742143639480466379077","85282335728970902773934333448224923924","319440907584164452038868100939594996087","203310192476709982220269851353250627798"],"threshold":0.9},"id":"CVE-2026-91860-98106e94","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"},"deprecated":false,"digest":{"line_hashes":["270064432359579580076235852296308999471","31297989078224108306026391392933587062","193640368209559062201530548907812445381","47349015229353814134605922319423142611","31780099556070361462176726419774538502","53467278015159944524510335949254227670"],"threshold":0.9},"id":"CVE-2026-91860-981b9b72"},{"digest":{"threshold":0.9,"line_hashes":["89455094992706848882219560453246704289","184773115111085186161434946742064021753","287702400723949005411831341744797501513","277238228141301508550489084180834536063","230104132238528120452058792616525685498","63206207566607191317657833327182934635"]},"id":"CVE-2026-91860-98a53473","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/EmailField.java"},"deprecated":false},{"target":{"file":"vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"},"deprecated":false,"digest":{"line_hashes":["188955872903654492216388914638133212854","96067614133234538814144289917933158223","15792975074872021262673902516588493961","212861641974843638425040798069764743113","48435976830759833605795897185317759421","25807009063683446370478853981472653538","255002618588899229101184740783834607058"],"threshold":0.9},"id":"CVE-2026-91860-995ab1d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"deprecated":false,"digest":{"line_hashes":["73113795437636250337321382749251574859","268553614403655341714282016820784300808","14554019686349229226289952234911669586","216097515817509548636234799582274729824"],"threshold":0.9},"id":"CVE-2026-91860-9ace89a0","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardSection.java"}},{"digest":{"line_hashes":["294707649347153029405421350152206022372","289320593152719182708559373848438430250","182783921290473136252140625853475583224","166895127300125691071248134695360622117","230644445349521509569488243246452667592","158235741940916407700951219136474683682","119887395962312828079291059994691821828"],"threshold":0.9},"id":"CVE-2026-91860-9aebe935","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["4252397771718907214816543802811780961","203682811904211726706773787491852329753","247806510149670943726691223433383638198","300829172236222065131946397185898768365","247998809037967485703080966689541699493","146805001640389271271665854943949018483"]},"id":"CVE-2026-91860-9b7a3bba","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["135163134023661399101076358198769646482","272817857918727019932458361006249733080","51976246831853328126255003473374627649","184165126111819592261379437563597541898","281277479688975817295120033539535409264","213004463680310334186615357280747041199","103183608564847399837648108642626145056"],"threshold":0.9},"id":"CVE-2026-91860-9d25c8e2","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardSection.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"},"deprecated":false,"digest":{"line_hashes":["82465081527692526402060435399892962443","159177851704651217439589715777182690789","277978493726565810510509977458218904244","191039007739664202817256575610768859567","294029928509718505220789978322275004333","112575547365222581705760579345821413408","201442886552379448809319985910642586798"],"threshold":0.9},"id":"CVE-2026-91860-9dc980ae"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/ContextMenuBase.java"},"deprecated":false,"digest":{"line_hashes":["46935872803836794102752343038521704407","310213531760686522619586468958114768071","235384204806932755774827487713689588561","193424572134930982267340407536578474855","313213175944018409705065377228753848171","73967241968942362997205520195817440573"],"threshold":0.9},"id":"CVE-2026-91860-9e49b2a9"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["269703463402619740055975131044029090305","165793450725239033137659362075864980668","316935609457901331552860792768068888271","284419610177847437230491598774949154247","288979666781226988292671552440469558702","87354922235235327783240364723539680819","70652922328652635804157113041361035290"]},"id":"CVE-2026-91860-9e505fab","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"}},{"id":"CVE-2026-91860-9f79c043","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71298231999110877854977230871011746485","50033616505973103442599045217786086990","266761223182232786887719926953885551820","17309129211923649190311030856821621394"]}},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"},"deprecated":false,"digest":{"line_hashes":["183661810790771756276600647785215593335","163953221421388512769752447468725541283","57044506158293758226761417118269150011","148539533779514203998298939821174617487"],"threshold":0.9},"id":"CVE-2026-91860-a01e059f","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUploadFile.java"},"deprecated":false,"digest":{"line_hashes":["3747459429878414448462577926462842449","218524146567427119372410935870638425896","143859476620716492677025939397642586699","193347563249656837090940636136910768252"],"threshold":0.9},"id":"CVE-2026-91860-a02bb5fa","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["292021646779122297545106900446304053758","50484194930506747024179951824785831322","296531537221491376102505939163439911343","185700480790560942677798551815932028265"],"threshold":0.9},"id":"CVE-2026-91860-a05697e5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/UploadButton.java"}},{"target":{"file":"vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"},"deprecated":false,"digest":{"line_hashes":["100839270956576169588477955253773809038","186314345834809138306556563359335897327","117640065616668742211183891099112536411","129259114258998560937028265648375942326"],"threshold":0.9},"id":"CVE-2026-91860-a158547e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498"},{"deprecated":false,"digest":{"line_hashes":["35548971261736464652740290540666984209","284144111876692616287812896496231947206","124215852962832153935805549777140868581","58472845697157076654006756153538043935"],"threshold":0.9},"id":"CVE-2026-91860-a178bc25","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-breadcrumbs-flow-parent/vaadin-breadcrumbs-flow/src/main/java/com/vaadin/flow/component/breadcrumbs/Breadcrumbs.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"},"deprecated":false,"digest":{"line_hashes":["114410902717654010894233428950214619278","285672836741330026445817111281582336626","155771577510833144557253140924623695912","275543087307107646055022490908315450425","283284371600428530737359669766567409311","252379708843453306825306218868606876445"],"threshold":0.9},"id":"CVE-2026-91860-a2708fd1","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextArea.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["21227522182542128695877441772043364054","280232788834897151624455764562425060218","326802776617848061725822318490912768969","124621194736784945557835360886083322751","176350313577864214163874374920187502319","107149033961027880252532211751204042686","151504935647717589128606775739355363416"]},"id":"CVE-2026-91860-a406f317","signature_type":"Line"},{"target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"},"deprecated":false,"digest":{"line_hashes":["110884903166894414314094557662559942039","206630681242459063977873026595980177567","38500256514598055381437606712815889267","273309716519723668405782285685164996321","284309102270475709302381221947756978119","8916090830652495843285792880063796135","170452268445978674027321881128146511287"],"threshold":0.9},"id":"CVE-2026-91860-a52931f4","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"deprecated":false,"digest":{"line_hashes":["175821896079906491546495407448054900385","262052391982764164545261375368314616747","15795385505584747432708366944930097165","156503663235108745445757867469600065911","126768361933395370752796233859934781458","262238998175482893271011138426646907322"],"threshold":0.9},"id":"CVE-2026-91860-a7372f30","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/TimePicker.java"}},{"deprecated":false,"digest":{"line_hashes":["140897548586509453255628883461954810508","330253662261774958689576399451810112421","61751914351754773331308455192880657983","269095706675813886136754853786467146252","75686606371502851043618542270166160766"],"threshold":0.9},"id":"CVE-2026-91860-a7b3e490","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-popover-flow-parent/vaadin-popover-flow/src/main/java/com/vaadin/flow/component/popover/Popover.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"},"deprecated":false,"digest":{"line_hashes":["158083999616970084865558401558314138505","301695222334958291631607068421150655048","128637682445616260261516030105850246680","331867424061267949356242511854035605008"],"threshold":0.9},"id":"CVE-2026-91860-a7dbc33f"},{"deprecated":false,"digest":{"line_hashes":["331840309606413920329566731680531077261","325775648053078910998965466605552940276","188513189907641937520674316385079768433","303556764474508714310000007550364481805","98312673574687481808221658700288328207","325450817363175960243334315341871449741","128656164862467941083431583963133406895"],"threshold":0.9},"id":"CVE-2026-91860-a7efa864","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/DatePicker.java"},"deprecated":false,"digest":{"line_hashes":["306569565186884312448394043083856876040","90913666099664839297555284851725856672","215703293011356304502512298546875971308","304953966273949263627944950483557190274","45613749521986617246012348557826422543","35685353617785912056710020076124779352"],"threshold":0.9},"id":"CVE-2026-91860-a8a49ab9","signature_type":"Line"},{"id":"CVE-2026-91860-a9b8cb03","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/GeneratedVaadinProgressBar.java"},"deprecated":false,"digest":{"line_hashes":["302266890798810844425583005350020712785","20653944505422516373720386232501031556","47268719125627302469474966406424366815","203545127554392161980370111385127632494"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tabs.java"},"deprecated":false,"digest":{"line_hashes":["329258424847658363934542711335871296912","246230322393379731114375459334178226493","268122333928359557283787905973128022238","103453545790890714471122148632630658795","267413017143827733860289377460737788883","184668056986977873622904075461446892962","287576625282471812304410175774539171795"],"threshold":0.9},"id":"CVE-2026-91860-ac564f0e"},{"deprecated":false,"digest":{"line_hashes":["152465361100995071184113446553309529328","197735841289552272421653618005349438640","87599765616459415669821548397108045059","256903787323307877437183775589307346145"],"threshold":0.9},"id":"CVE-2026-91860-acd8f4ea","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-breadcrumbs-flow-parent/vaadin-breadcrumbs-flow/src/main/java/com/vaadin/flow/component/breadcrumbs/BreadcrumbsItem.java"}},{"id":"CVE-2026-91860-ad365234","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"},"deprecated":false,"digest":{"line_hashes":["35042164962131879423852798472665158984","334338804907630990117763142230653398557","152085211708504497443025724518187746021","313393773274946483677080789133281606609","34275494161687850458375209920254636276","41417433753614015572062946356799612718","84329100855289328211950208530206453166","85313434810737355423842705408109276654"],"threshold":0.9}},{"id":"CVE-2026-91860-ad89e4fd","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"},"deprecated":false,"digest":{"line_hashes":["198886245835771555799255607358840987212","131111832254518247591204311786984054682","18327617528390065991835634439128094637","57370576604096520726657801655081113562","31539705499914117702692357079283020607","81694484141645837258738186516998324097"],"threshold":0.9}},{"id":"CVE-2026-91860-adeab348","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"},"deprecated":false,"digest":{"line_hashes":["198133348019911184215383447763754614775","180647126960723276888069377989246825336","48091453683052398371122987333688223881","116946763914749595870013187288970599853","15017311191612649133838898487718693642","185594591336112113564536720966860993858"],"threshold":0.9}},{"target":{"file":"vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15561949018290956864858030243628250254","98402311974612688047225984858482205445","206136158880437953131080087931352726743","268081317950629857808859215976786398718","304913328062575972807921735956352408873","94485591114044306308186028280510740967"]},"id":"CVE-2026-91860-ae06fdb9","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"deprecated":false,"digest":{"line_hashes":["290602405391722824758593884556281563324","45562812048430893566786838410913597554","95962027479079802825658536394088414982","74378206895964183901043479553977895861","302652901202117598265292436594201667966","246395884098897398283115628236714287501","68574240783192397774013611505769785725"],"threshold":0.9},"id":"CVE-2026-91860-afbb6094","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/GeneratedVaadinButton.java"}},{"deprecated":false,"digest":{"line_hashes":["157618035939260416624303900298176598989","301373085352754471481466939801004927416","209047635362721052828370708416842238722","57149809821657081314195817723156614097","17020392855735474254904159052154397284","276226431468771808046151862758969302532","44173318426708978767428596523017735001","75385984258550474494979230331427111655","44577620567949090085282011164139043283","291006460486519518492116388394468770274","192777481132803751958892886508463001286","188278385786347862102741975298703166764","132795863756969832695605223751728329676","190383862081031616478265877132169662280","299607987853524260189308996789227812560","137747352174428328055239541980395793306","337991211691687789478692762572733787919","20852170086004971186537977360973695699","321096966137212934089768556273678824177","331225987917223565639750072257625483771","33418372602960645112421985380394916565","43921841694542266475714577875484314694","101964898985507069036018755971491519274"],"threshold":0.9},"id":"CVE-2026-91860-b071f503","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java"}},{"deprecated":false,"digest":{"line_hashes":["264810375198202281052237583333885872748","120330610410566778273474244514535347597","126691195870628948406246533844756236586","59899086060179810590802816856019812605","160831976443012732529543374476821988804","219787878045153420824300055572897279452","308194455916845101429284089933925160619","247534912660287641774070804226394957948","191151246788996757670849488782924154784"],"threshold":0.9},"id":"CVE-2026-91860-b08c1a0a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"},"deprecated":false,"digest":{"line_hashes":["127403949388793812751790920998532279342","171271229392313362031687611679415814400","274559978183589632573428361096790644816","262512437039626970798085267630357462772"],"threshold":0.9},"id":"CVE-2026-91860-b0e12764"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/GeneratedVaadinTimePicker.java"},"deprecated":false,"digest":{"line_hashes":["36014278876800646412415183710643565081","69805889774702802594681815102630197897","265337545633700122557546308763505064160","333730949719838316842232000309093880656","329683297791299968690113918906685090906","156478663263092608479511778792929503684","337269462531029046172730568955292921695"],"threshold":0.9},"id":"CVE-2026-91860-b23545fa","signature_type":"Line"},{"id":"CVE-2026-91860-b2751482","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTabs.java"},"deprecated":false,"digest":{"line_hashes":["249026093832844837766830785197691709380","227912246111322214563542748846531056106","151336125913051794608279045107913018923","321317797643847083961534643390412351720","207249037672481594696392284328317296460","185433344719776604986282149734971586258","52444827414347959589929221579200508955","285084676521978198077518627414966803100"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"},"deprecated":false,"digest":{"line_hashes":["52765728604631931388722088860675118360","291987060413712714197744564977571985619","31101689248137221143283147649534093298","267706409067167793430134184604493580266","271936170832283257622679772524681051672","114952147493081416219437395782647828788"],"threshold":0.9},"id":"CVE-2026-91860-b2945dc1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/CheckboxGroup.java"},"deprecated":false,"digest":{"line_hashes":["147902836278351662522347094240809926783","114681597478210789109870131579337225527","249276930013983055015668982764002099197","88383475362077328659238010823989895062"],"threshold":0.9},"id":"CVE-2026-91860-b2f1973f"},{"target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/PasswordField.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["231387156178935617898739513793413437748","107871831655797976711792289272576776499","89273277111318696654785613474171316143","120743902296710881328578934742470336597","303022385357953223381049494538188268985","173922398149373533726088923941560267176"]},"id":"CVE-2026-91860-b3523281","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"digest":{"line_hashes":["29634425887807995656816279956715852550","148006298376392769693477096730577399975","336533176826674679168695306384563752982","301790761505480666990302368281790750130","295340421663442023057045762499203004175","242073429964776128390434430786425301890","66307494969066130369855367427108709878","58135636467803864970574641077021477216","284467156388718033929338434368438205976","208240229691672722908223414062994876441","208790956448946594046597343173051871255"],"threshold":0.9},"id":"CVE-2026-91860-b54436c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"},"deprecated":false},{"id":"CVE-2026-91860-b57ee506","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/PasswordField.java"},"deprecated":false,"digest":{"line_hashes":["271388821673869829407794230721962429974","232310694496046211525714199084194797690","216445786654131497352977782079791942166","107432573095909485568669394175618893033"],"threshold":0.9}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["166991970097207763098882341709530345157","99643428964889711427624689777016277716","36002910287982724568136914702364550851","35735164940356661782080437227165139322","199250534797027582648617535250989794050","255367305213772629138460332344838658936","82095094985122493580687082607073149202"]},"id":"CVE-2026-91860-b5a4073f","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"}},{"target":{"file":"vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"},"deprecated":false,"digest":{"line_hashes":["173736766828775672733249859485797734776","324595626210917538095541670933011559361","252176140224135733305343346491111024571","273677490586445197100033188045981050701","112670577977649907233659613539289679451","279469753425258577116084372989087953827"],"threshold":0.9},"id":"CVE-2026-91860-b5fece46","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"},"deprecated":false,"digest":{"line_hashes":["149286409461437386191953540480133784087","49893343540222275457444686606027682991","249811514533215902220728379827826410075","91103122562431492031006384456842969936","121962156312976409413971193791180840985","73118177241664850946307267252691107143","174667181549613192901529913923084661747"],"threshold":0.9},"id":"CVE-2026-91860-b64fc7a5","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"},"deprecated":false,"digest":{"line_hashes":["71687896583188192026300235114535837854","100041569795686277469178249930404779148","87713070843503317570493158264591969877","336198618098942297917097350091468782784","123981362139938307046053353726270195035","89274431546160161657995060864567856671"],"threshold":0.9},"id":"CVE-2026-91860-b78bee00"},{"digest":{"line_hashes":["16737564262995772171574308722993530448","321044719298573500035259504410505310738","288899636742328523412543577990877804921","15212173775034213636395645419930287312","282523647538093995213764344493402038067","15443124746952533375991441029749541526","37014539976917280432164335953063216599"],"threshold":0.9},"id":"CVE-2026-91860-b8656437","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinPasswordField.java"},"deprecated":false},{"digest":{"function_hash":"65313709292149367055722205061676845717","length":209},"id":"CVE-2026-91860-ba908aa9","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java","function":"DisableOnClickController"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["274010816636142188604979890642516895603","256855816368385195845086429305827913901","87438981867710216480630608279074385043","108195188889407327178572201299944080550"],"threshold":0.9},"id":"CVE-2026-91860-baa6831b","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"}},{"source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/TimePicker.java"},"deprecated":false,"digest":{"line_hashes":["150419936935118648056025105239334948919","158721021022252648606455676746730628846","44822633323437605094242224521113144417","219349563143839809817798851199102487266","208977375263161438666244749448529948819","160129893080666484571235124464287796360"],"threshold":0.9},"id":"CVE-2026-91860-bb69fe53","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckbox.java"},"deprecated":false,"digest":{"line_hashes":["133649201688321882713428026178444800203","161460649361402428975023761658687440207","37471200067585969808876757234530854469","132151675085800208527943916776512595085","78599188599561770387804248239393072746","240484443808672308446145218953409535267","77976230274680133791950358573498791613"],"threshold":0.9},"id":"CVE-2026-91860-bbaf49db","signature_type":"Line"},{"id":"CVE-2026-91860-bc01a814","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b","target":{"file":"vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-testbench/src/main/java/com/vaadin/flow/component/spreadsheet/testbench/SpreadsheetElement.java"},"deprecated":false,"digest":{"line_hashes":["176446288448669160668152096212791716267","51172496757670748577728675721687728396","161446562570766516118178200336455550423","119034231884320478917072653750616123420","258817706310009778471909247500372899447","133566092414396898935956466281634736992","37725719197134004075259347108066180024","292160898745200375474015252073470360127","147066646078768702799811365504531619510","297769594631884958055643511102716002151","162442997946872021388922595788181467267","383181013305790402247557322927332202","32404028509127235974663563457104100612","135137754573002149104388871522635813342","283573751331020850187069925886075930015","204731232221937085948434315753651673722"],"threshold":0.9}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["90189125370997071544374365788492381734","22952883290610557320444950724107806109","40363020525227787396328421003778967687","126967311601152303430399103371801157151","153933206325780713787939423463694346495","319528179613358025847518819850490713232"]},"id":"CVE-2026-91860-bcf11de0","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"}},{"id":"CVE-2026-91860-bfe55a7e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"},"deprecated":false,"digest":{"line_hashes":["141254999736853411589955063676087566762","124123435255544830649229379373588930177","155811608576675757373664519023147258894","289166073870852772515127063179132506273"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinNumberField.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["318733234789774818013650823559243686166","155467279564625194386739517009555657317","200820764168340039774082095617125422829","20638871805355232654075664399420613093","182700517214039798156823143991123182341","232486954604430196409508624601680190471","95009472817351924470363736855953106800"]},"id":"CVE-2026-91860-c05f9a84","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["98895446551604758619411293596237418521","199484307610275145703672764982313811350","321043356010759443170303049750067416353","301115134745820776470104782720761142910"],"threshold":0.9},"id":"CVE-2026-91860-c0a1913c","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"}},{"target":{"file":"vaadin-master-detail-layout-flow-parent/vaadin-master-detail-layout-flow/src/main/java/com/vaadin/flow/component/masterdetaillayout/MasterDetailLayout.java"},"deprecated":false,"digest":{"line_hashes":["224678957177597718934526309793364398677","4619521005397853846112846261394986283","282549191241464396626287293544394896384","276223140941862987741957652856109397514"],"threshold":0.9},"id":"CVE-2026-91860-c0a7263f","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498"},{"deprecated":false,"digest":{"line_hashes":["309975468474318353839217021970465566637","333755489576190461433347906536437540206","324454681978454187514866780191748448525","294158281889822948694193604949367872569","159340278353462200744578785302375875233","163888706848604664842917367183124503749","196904199577737551040686418742049276703"],"threshold":0.9},"id":"CVE-2026-91860-c125593c","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"}},{"deprecated":false,"digest":{"line_hashes":["180141291149184250001452368040182158851","78905636423993835929364599924964625905","284996329903885579103375207063790022016","69750172001125068317260181957969991552"],"threshold":0.9},"id":"CVE-2026-91860-c1722bb4","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"}},{"id":"CVE-2026-91860-c1857e20","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/Checkbox.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["333098910638285193024461847077643690624","222064814049316730459534335397256483470","234209131422757025936346482873363561488","224528267266378108805697411985575452397","278946569119644145080315528425767623845","198871462289725439308928193111063346004"]}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/GeneratedVaadinNotification.java"},"deprecated":false,"digest":{"line_hashes":["10211340479860090629743656628918047453","197197139648245230132094037020417659335","281093077021474695394089753112861441455","239024325104691876018229511024783319125","246974244694991156405771888586260879867","118128784499318994019221069580147163366","36586547179933324992191329955906359525"],"threshold":0.9},"id":"CVE-2026-91860-c2c77763","signature_type":"Line"},{"digest":{"line_hashes":["92037669221102092040257544224481820280","190240983060412709191850445903652188304","167864057505512437866167909660207789872","250295545323557330221479191523461135456"],"threshold":0.9},"id":"CVE-2026-91860-c3769f9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-aura-theme-flow-parent/vaadin-aura-theme-flow/src/main/java/com/vaadin/flow/theme/aura/Aura.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["177389250951014184170036257879878918626","220105238656871568294055386973303538771","282928620155138978538660882224627319385","220548810105824004597843205497345935223","243817753249758974462832626582626017494"],"threshold":0.9},"id":"CVE-2026-91860-c3abd03f","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-master-detail-layout-flow-parent/vaadin-master-detail-layout-flow/src/main/java/com/vaadin/flow/component/masterdetaillayout/MasterDetailLayout.java"}},{"deprecated":false,"digest":{"line_hashes":["8812401745622458328013314935741214536","93360934688239340527432361430750653229","171634759256188382954495945082677015936","243461003899545665457202524035460502091","201163003862185359065176912970131386157","309513981656391665030823739605140455706"],"threshold":0.9},"id":"CVE-2026-91860-c40a0fe5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"}},{"id":"CVE-2026-91860-c416fc59","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"},"deprecated":false,"digest":{"line_hashes":["177730825871372786675754190791750619927","338936118145022616229490874091614496760","327292825193664473580486174633809916476","253611163241845551610714254604715099783"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["329414134790064852884975893970280166577","282753974693224070737183650208337704276","92872956231527002948146824123797777665","160110925134789766287407968421647566431"],"threshold":0.9},"id":"CVE-2026-91860-c4b2d919","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"}},{"digest":{"line_hashes":["3342279977513093176970665938915846120","239833703289252027300793526605021379528","144933193019561968988947999866286125408","208725067024108974578700960554391822699","229386877056697493603325186648549003887","41249130166745236839110125269494868487","316678280554179526858592193552217055253"],"threshold":0.9},"id":"CVE-2026-91860-c59b41fc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckboxGroup.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"},"deprecated":false,"digest":{"line_hashes":["4827428237103416653736144511082013209","6426941126183938930805913743636175247","1643042893493962182316541568187031770","132816427414506108325402453362405713183","311277603720540673589321830646352421524","223914355692086726399853431745909410617"],"threshold":0.9},"id":"CVE-2026-91860-c783b7b0"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"},"deprecated":false,"digest":{"line_hashes":["183669286758542800120904956231759528192","205429302556979600339439108756404100555","235534367202262392586638265760869078284","319249785718410059994689155645158242832","210330053413338236976855956759378309607","110111601403662786138931812398206680516","156415189788446967557805847297882099586","201473658986729545135508816026288167087"],"threshold":0.9},"id":"CVE-2026-91860-c7840414"},{"digest":{"line_hashes":["131525592054914507540317179577882337130","125325056193731768725758745530362255649","336309790282939443550740241950851412860","259056891229067179037717484532349982624"],"threshold":0.9},"id":"CVE-2026-91860-c79e2eeb","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextArea.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"},"deprecated":false,"digest":{"line_hashes":["240903965976209375421329703516528232008","73840733230380118058507984729680356100","190163264086625902320709659517683946632","12630390578715325660539733030003807760"],"threshold":0.9},"id":"CVE-2026-91860-c7a4d233","signature_type":"Line"},{"id":"CVE-2026-91860-c832d441","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"},"deprecated":false,"digest":{"line_hashes":["53174304183790473236627236188218208744","160003041334328415913182453814329884097","131530869619032724116823952763895633088","123332006124899083121142119172575972041","75195974440879870880624431570385652582","57388169924170097358997252063778331835"],"threshold":0.9}},{"digest":{"line_hashes":["78395073329020520623438248192628040464","339104554699788170545883616731954947967","131153752964024706475984977886578783259","281919776274759583302666677542502911401"],"threshold":0.9},"id":"CVE-2026-91860-c8ee95fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["261096695847330342692957108235924903289","214863991200359001235698698349165124207","114585087282834650559152506162676086601","272401944667445204672630413858896526939","96353595438993873273713473312081117150","207008307303940956643571610714505083442"],"threshold":0.9},"id":"CVE-2026-91860-ca691241","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/Dialog.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"},"deprecated":false,"digest":{"line_hashes":["330506471542515441354975643812961963540","198005943193814706200968990520913847038","282824830990271270683209074571207955197","57414479550169342827855373622836420056"],"threshold":0.9},"id":"CVE-2026-91860-cb14a039"},{"deprecated":false,"digest":{"line_hashes":["18371024278773279009686390908310846763","231435679930629049933529924949343226518","260595111618089837212728137714059874138","255530565702648763992088621495545675785"],"threshold":0.9},"id":"CVE-2026-91860-cc2f3695","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNavItem.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["278100794721167360048137759916154341070","108262889008907096408631381616588939878","127821504474419133497086809258505977930","176869979778338198354915572869476972426","197765027633908488612896606814330877941","153924066422215965995045505689317574365"]},"id":"CVE-2026-91860-ccc37391","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"}},{"target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/Dashboard.java"},"deprecated":false,"digest":{"line_hashes":["121984601068339227434759495420254420013","158256370065199787613661701746142236260","50476181599199803337256754141180226403","56244522438510497011926982637315837141"],"threshold":0.9},"id":"CVE-2026-91860-cd983f47","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498"},{"deprecated":false,"digest":{"function_hash":"121197145329376912083425646820988589471","length":107},"id":"CVE-2026-91860-ceac5666","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java","function":"onSetEnabled"}},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioGroup.java"},"deprecated":false,"digest":{"line_hashes":["192923233484013268518831943021142354284","157876665848436088383765916788720493587","55824247868731363346765442643881428274","335767160086616160531986363660508886149"],"threshold":0.9},"id":"CVE-2026-91860-d10a1ac6","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-d12f6b4c","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"function":"setup","file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java"},"deprecated":false,"digest":{"function_hash":"89590505678001962171649155691520374787","length":53}},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/GeneratedVaadinRichTextEditor.java"},"deprecated":false,"digest":{"line_hashes":["260747726235634794993902707479722896541","274803150691726496786879479267409702927","254889689084794453491094603592138581027","261080555089734841723742780926909350014","167196598393875690145642349052954543126","129034739790214737723583443118181997222","138704386736152255969783093637196845325"],"threshold":0.9},"id":"CVE-2026-91860-d50a2f7b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["55867907455324026252842586293913473620","124279539426604187219272716934866706634","172807652329336520626385706880896064320","64159016542915641345037186697218679612","158896573315694351887464014180434797997","291535468425470781956832192260275694922"],"threshold":0.9},"id":"CVE-2026-91860-d55adc22","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"}},{"id":"CVE-2026-91860-d5c4bccf","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/Checkbox.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["95092792887154945876297860936402035741","18250325302498486248454926231119437039","275587563386256548460098150364142300902","202737657364513432027806318241017588751","182533260279693789486370646932500423801","193146619926538000627816471212370809238"]}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"},"deprecated":false,"digest":{"line_hashes":["96253781867492923467567753191667624152","27495192199598629596932909769524064210","19777797266879284197046101421355569555","166751356161050925113629504721460904355"],"threshold":0.9},"id":"CVE-2026-91860-d631f665"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"},"deprecated":false,"digest":{"line_hashes":["226855994141996117475076780153428540485","264534135685506260461601246905434241130","229624474653673918765102315826200029534","236052383437861261048700258546331288398","326403687717605790144277921472401249406","23806425209920162597934474761240600932"],"threshold":0.9},"id":"CVE-2026-91860-d6883333","signature_type":"Line"},{"digest":{"line_hashes":["205951376391069267196604803010773907500","4429185846125205710042750124718142523","253227547494052602564895738491455719803","157828555541930519647053402094546558080","305770883340729499432310333623248077040","117220362942526222545941434261084873756"],"threshold":0.9},"id":"CVE-2026-91860-d73e42ce","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormItem.java"},"deprecated":false,"digest":{"line_hashes":["184820732948850618140671532857375926357","270109894138226848586803395009304662431","254284928612152137228660671993137850075","228042695521773983100669147966890801639","237985893107015460913338252594878977361","8707089422255774151057341133518027958","160675206649894703226676680386500833910"],"threshold":0.9},"id":"CVE-2026-91860-d80cf431"},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"},"deprecated":false,"digest":{"line_hashes":["232562083477994246111525205191154934378","167026745855539056612828163865245895028","219144990544038540987374521677272060052","169743552228910566575927987996987767652"],"threshold":0.9},"id":"CVE-2026-91860-d92b7739","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"},"deprecated":false,"digest":{"line_hashes":["54120876331567284695602192080939076036","117913940121280536531590404252805944331","177124484198627963711523283945303378489","156695881640265206010360041180231201257","294227337398041693403898550988159693138","198899983454843694563503985821113548030","285619449932104951334824460786705087677","135009687869955359789898495282584875540","294367295064759541093190936940143707248","146234329776338507843145688569628168520"],"threshold":0.9},"id":"CVE-2026-91860-d9421c83"},{"deprecated":false,"digest":{"line_hashes":["178409859599580364076013607338343161641","4283657693119120559931922632528619753","270090802447780172166548921189979013831","95996965933070721681184183875040009081","315096021252706098078047898089966599136","122451842872007571377824584353444128104","125878991264999283972105658645987241747"],"threshold":0.9},"id":"CVE-2026-91860-d9bee8ed","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"}},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/GeneratedVaadinContextMenu.java"},"deprecated":false,"digest":{"line_hashes":["147669706542717616439282489690739247534","174352132234405669341520822581396995963","144041428412646472414677686290797476085","91678603034938714167609422266820857069","175482217806722228465822415951516733884","278989618549371147626777820408916959827","61900266636437648613916898349232198225"],"threshold":0.9},"id":"CVE-2026-91860-dc0db0d6","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["38333526010080923774144984987436253862","312064588604631431423200153242833140581","135146039892167325427567347385600582395","324197070547200402649772595427228435117"],"threshold":0.9},"id":"CVE-2026-91860-dd40d2cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["52995085335349422927189027908948073897","189607026258797204403989474405849884517","139954651465756643098670647617781912383","207963322145916820614406141981438340382","259372674652144344154578017219247243933","210390150033737300945364585131220571623"]},"id":"CVE-2026-91860-ddda4565","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/AbstractIcon.java"}},{"deprecated":false,"digest":{"line_hashes":["18676328132211688880314801964157211545","181491188177085786915935873443388485065","129315625310577407291526703446109184991","270021243541139207973004647489683418500"],"threshold":0.9},"id":"CVE-2026-91860-de7ad2d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tab.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/Notification.java"},"deprecated":false,"digest":{"line_hashes":["219136172111017897538951743229443599289","173339119635653391869122539730305117661","241416293160508843389593859659777565584","336688963961851977502157171770680424139"],"threshold":0.9},"id":"CVE-2026-91860-debec9be","signature_type":"Line"},{"digest":{"line_hashes":["24588367150627522803636823808920126126","35540117873352386583481313303616751296","197889821325157595070411410995730237297","26935993793985600000481123661025490379","267039698358003992240218533242898572789","339976198511858155303440167252006097236"],"threshold":0.9},"id":"CVE-2026-91860-e0388b13","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"},"deprecated":false},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/TimePicker.java"},"deprecated":false,"digest":{"line_hashes":["24669750679548996546371324026464379686","176528683809949873575372025474285526151","240333772083244360887495283655853560690","22507232240435940719390395970335637054"],"threshold":0.9},"id":"CVE-2026-91860-e18d73e1","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192296712265805911827465241878700714450","85160900996113503128956864962449100955","123033110637364046102402564600393040007","14724920941767003978379020292356879963","328168190565018123612562488294530931178","252822266523987084777592728934114258675","99509896750817620317110092883861233837","139430338815560722677403032253587117292","89682221290037726859613428174823396368","265587249170633488161134699313542747946","183342365252072769986093456072442539639"]},"id":"CVE-2026-91860-e1d50fb5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"}},{"target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"},"deprecated":false,"digest":{"line_hashes":["191860439106752249323021692860699066204","71464516573781233228314870475162485668","32408176818192687400076215958244348394","23185627613605651595169475830325122691","94428060390787824053014581862331692670","324118995694503812041571215181495403457","217571457287876582444692797635456891024","194129018500960397843216166133903039185","83616179873273858244473773622149508218","59572504711267720040579070320943001315"],"threshold":0.9},"id":"CVE-2026-91860-e2987258","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"},"deprecated":false,"digest":{"line_hashes":["158956854173862883231697465835802204795","253071534175469986882012117476462793055","147415372569674242283542252767042408708","250183497971373303027104107435776257915"],"threshold":0.9},"id":"CVE-2026-91860-e3c83d67","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/FormLayout.java"},"deprecated":false,"digest":{"line_hashes":["324909108812765643266717812242778839075","200552509115702042003430046821141610998","56738266207580052426548621755525977767","127018133913730763154795885067442767345","109021474288552253976742408986048927206","246696404724657062107660992248567184849","99569988497630327971142390919684155857","239746907180037256391592543379595761991","58367914662732140014282050217964270162","78845629917007595518444751206016985727","277962491704580245374287124712531228621","55780067355118373281107346942729864437","63881982723800020823892555988820619658","132470354739878749983414191227494879701","138990014135576467422026462400178069482","177079465727169166762267521853013049631","38757122445383565964990273687221181121","156464195493341667508021394325398778961"],"threshold":0.9},"id":"CVE-2026-91860-e5e38c87","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-e625cd58","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"},"deprecated":false,"digest":{"line_hashes":["192329059073254750513606212101221384874","180943010683760263249829063912135678243","234410037697209723780524979160972954692","151047092474898276114688905185862017636","223333410363344982017360321498412900372","138430943657945561151306684875164158991"],"threshold":0.9}},{"target":{"file":"vaadin-side-nav-flow-parent/vaadin-side-nav-flow/src/main/java/com/vaadin/flow/component/sidenav/SideNavItem.java"},"deprecated":false,"digest":{"line_hashes":["60466015480794084010896739354381646870","94452847701506055991667276160908646860","181513117016016316911611517085885079091","160824915788772081597022225203571567048"],"threshold":0.9},"id":"CVE-2026-91860-e628a3b7","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"},"deprecated":false,"digest":{"line_hashes":["42046496615389474478454136954585574973","137213126093052780028648860988193138426","30210259674537928935746376912896751093","312503973570325194459006266512405338310","1644569097599648477522497553528839129","133680208679220286926930064643466881572"],"threshold":0.9},"id":"CVE-2026-91860-e7333931","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2"},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"},"deprecated":false,"digest":{"line_hashes":["176352780528610596352829206914850699578","204216569352616418805820514424742952613","79746905926501995262444978647515138788","43831578632069609362337829713533229097","315630955067104020032261822135241002266","232780999100578530199219697844990648234","20292534472759026292110127631612979210","217953999189421067071060866498281131599","194229892343777343755897957095857300227","223827178649159926347602040964154700856"],"threshold":0.9},"id":"CVE-2026-91860-e80b6469","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"},"deprecated":false,"digest":{"line_hashes":["5857785452548414755817266145956795382","43965841130739584877693565112681674380","28359387996710298105157072281698366073","97783492159759310902151213099048037680","238448852279520405248344850452520791884","225601996721719793524705491405578243232"],"threshold":0.9},"id":"CVE-2026-91860-e840e285","signature_type":"Line"},{"digest":{"line_hashes":["236365180443322534775786162807195468276","73881263462528490227162792187723418805","335050402150907510262695574844648875798","76039225499072543023272505724714802083","211426072065987685837483016118859488123","333048899618785237785388157062487563456","307531424693958850275883946342086837797"],"threshold":0.9},"id":"CVE-2026-91860-e8dcbcd7","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUpload.java"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["257075176557295510969553898176365321895","36143856446284484986314357789197955826","84243838432235109917043645487402641171","98143144375766310238982139924705889397","43163238689032577522767671275458556677","253564246767682039351266270882408335464"]},"id":"CVE-2026-91860-e8e62711","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"},"deprecated":false},{"source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"},"deprecated":false,"digest":{"line_hashes":["66580252344200800708728825054098696005","55735781271644310372780299316643117171","89952733468002869539959235378239290144","270017455515672349929760184678466519318"],"threshold":0.9},"id":"CVE-2026-91860-e8f453c0","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-e9125053","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"},"deprecated":false,"digest":{"line_hashes":["112376591443091395327729255899770849435","96055444853123236059082287216788959413","122724927486030948856847641272297905095","113989993386953165702305104552937161075"],"threshold":0.9}},{"digest":{"line_hashes":["150342674734279018986913311984364212764","189116479633357713319841394203537225391","198904821055134531975397790128479991435","174491146136719261195563337129392836040","278575921083269841775987260212036186253","100193789278360082508201980135663752164"],"threshold":0.9},"id":"CVE-2026-91860-ea2ddc17","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178409859599580364076013607338343161641","4283657693119120559931922632528619753","289523620694156504099617473779800837597","86136592345527115335113386937895579247","221119717870450161430955983963491747771","291660602038352213162706322264573011905"]},"id":"CVE-2026-91860-eafe0808","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"},"deprecated":false,"digest":{"line_hashes":["145722886291486975660814916767687441317","283398575491932292468532871084502119686","337530875228623988325589722572741429325","263756645803717649572025911434993844122","232699191331286164389851153622882572691","116808368600302846366045506628423013373","270471735327005338892394628088495860680"],"threshold":0.9},"id":"CVE-2026-91860-ec04f4b2"},{"target":{"file":"vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"},"deprecated":false,"digest":{"line_hashes":["248330057012495454487572247953246174461","180204442388735139397723466421837262401","297080339719520426227060288276558130611","306303978961281584570462686019620492582"],"threshold":0.9},"id":"CVE-2026-91860-ecc391cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"deprecated":false,"digest":{"line_hashes":["13815067004143069899543111882143128586","112103474674105255932396273055809967741","236255626843846869474492473876312675929","87337028172708518251727991494507798789","136713122554479542046698291512585744007","119720610838441859460780518991162769707"],"threshold":0.9},"id":"CVE-2026-91860-ecf1a557","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/TextField.java"}},{"source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"},"deprecated":false,"digest":{"line_hashes":["226822749821337913641329762953286101378","1243651383976704865932335718335942715","254320238184914372510798270985596074814","60624482513920675153949126679280807704","147717237882824056457926772179762234338","304775695178382242962012828589488802445"],"threshold":0.9},"id":"CVE-2026-91860-ee83c200","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-91860-f2c30c15","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/Dashboard.java"},"deprecated":false,"digest":{"line_hashes":["51029728141426927443423404407178553455","334000510154668496340587742469131849424","29236368053577212028739906069307788975","3480324751336995277436978602762206271","279038537399629182634141154563017999227","112680863813770671988555694814399029503","143774145619136551772930690003327889904","205336578979903563054761540001696075939"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"},"deprecated":false,"digest":{"line_hashes":["12448788347901060262680827741367619739","18698722509563948865487027471465110243","250584031738477184849124641692573647288","35449937819355197211247567518570563980","314800432085723460941030117780871019998","111597249665721741040264613142628794680","270926575980090071813408269729816966497"],"threshold":0.9},"id":"CVE-2026-91860-f2cd9c6e"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["197596570033770273773293023317835702404","236240336678623817767030109389623614063","167713673852960545168154780249999720175","191664132846802933723313053060576243520"]},"id":"CVE-2026-91860-f3379bd6","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"}},{"deprecated":false,"digest":{"function_hash":"289850733904819289915873124456125618015","length":127},"id":"CVE-2026-91860-f3a90ee6","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java","function":"setEnabled"}},{"target":{"file":"vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"},"deprecated":false,"digest":{"line_hashes":["91951028405885603529608464456588725075","77515960301284391342811942679426384704","309344694132254390131530760637693199564","329874870270164966387374473972831807773","323398628452972801463737859000682208179"],"threshold":0.9},"id":"CVE-2026-91860-f3e3bf03","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1"},{"digest":{"line_hashes":["269599490507348265155871257285457494757","293743657593898740743254515732534430018","148453650396426894300535045808193945880","226864904663783040927368118247690474674","302562061313341731113382409032495294309"],"threshold":0.9},"id":"CVE-2026-91860-f3e3f8c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-popover-flow-parent/vaadin-popover-flow/src/main/java/com/vaadin/flow/component/popover/Popover.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["240382149252733595752779577296411855969","101772293080948172956170602989154569763","135227480374018299140246201256205472469","197828055984619559121822908012482629926","107615839872240406063989613637478037708","113496577171116847709610927543347904960","55989134884685624414937857417269361306"],"threshold":0.9},"id":"CVE-2026-91860-f41d784f","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"}},{"deprecated":false,"digest":{"line_hashes":["274932609149040602298771287482723707517","136050666714196085767469343603152023202","251305983740760768228582313271575161955","312634668288649058274394667866240875579","237206473368635964249828133944563834054","46296216548563532178304529595261822672","315926590596661818385053696774783007129","128052108392616781300791812383509892441","160897916107016636757719525330465840860","102132724580426537946533940885437391632"],"threshold":0.9},"id":"CVE-2026-91860-f5c59513","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"}},{"source":"https://github.com/vaadin/flow-components/commit/b5dfa61a76624c63ae172f6b67bd2f95a068ebd1","target":{"file":"vaadin-dashboard-flow-parent/vaadin-dashboard-flow/src/main/java/com/vaadin/flow/component/dashboard/DashboardSection.java"},"deprecated":false,"digest":{"line_hashes":["265631227800768841306171652072786034344","217660123443000721196813742873901738535","324684033440579997215617166673972922543","244567190959457820190723151019118302502","77948346513264943931701959800074989068","290760141021442150780193008997587982763","117538546644689925634983381931650120096"],"threshold":0.9},"id":"CVE-2026-91860-f61820d1","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"},"deprecated":false,"digest":{"line_hashes":["308665252251722873145388895931131189129","186037273815994831668880381707926035942","126263078102742853744189393412346687853","273309716519723668405782285685164996321","134186575095070449518200754652098371651","231592589758450559982797079486843689318","263600285041018052271331378962137191860"],"threshold":0.9},"id":"CVE-2026-91860-f63daa53","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["314239849463081837626662116026871919866","40819544071635864086280156850796281894","272029294195998623524008600937468662779","308004743110581958677270220773178843273"],"threshold":0.9},"id":"CVE-2026-91860-f8abcbf4","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-slider-flow-parent/vaadin-slider-flow/src/main/java/com/vaadin/flow/component/slider/IntegerSlider.java"}},{"digest":{"line_hashes":["94276477646408493954832018507023940547","182757860137575702682416780546250514954","242107709799511023902588548051151381608","220587816726680317879150837659690276562"],"threshold":0.9},"id":"CVE-2026-91860-f9aad791","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"},"deprecated":false,"digest":{"line_hashes":["91602766336236244725148345034290213031","85328319692893120129077792100927953557","109887592070605157179953747348562803453","227862431324833860908002770289434239475","276387030835032080432341915769555542539","330149476858262999937475748247749763558"],"threshold":0.9},"id":"CVE-2026-91860-f9b87356"},{"deprecated":false,"digest":{"line_hashes":["24354024704565345802620814345329621743","256648862011601953081470542271790020661","90007898484736010347855205367532137018","209921554060191245908162941839479592725"],"threshold":0.9},"id":"CVE-2026-91860-fb0506b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/f42344f998e577828f5876e90913dc8295eee498","target":{"file":"vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/DatePicker.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/Tabs.java"},"deprecated":false,"digest":{"line_hashes":["212894634908050527078725364152052580965","307292250101476237235182186792950756766","142077084051161680528232464568311666809","242448118962459207728140458397209068785","22657925223462645614219185068903368080","271682615335231000653387040404729496582","247686769594953430977488367028029236169"],"threshold":0.9},"id":"CVE-2026-91860-fb2084ff","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"},"deprecated":false,"digest":{"line_hashes":["9508557071637399550161041359353687340","59837937218965246552980404857641107259","227667882449032880771003296151132573151","207810676513227480308055326238014648283"],"threshold":0.9},"id":"CVE-2026-91860-fca04f58","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["74036628195031162648256930464928504390","238055527559313410322425133710324530348","224087161184047869577774296226181514364","310763007157685094172649024739815185410","104217364667103866705107284182307928503","176018216821294332387894985940057477890"],"threshold":0.9},"id":"CVE-2026-91860-ffdfdc13","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/1b71d38ff3b5bf96a80e5b88c620d9e24714dfe2","target":{"file":"vaadin-card-flow-parent/vaadin-card-flow/src/main/java/com/vaadin/flow/component/card/Card.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91860.json","vanir_signatures_modified":"2026-10-02T08:13:41Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}