{"id":"CVE-2026-93547","summary":"Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells","details":"A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.1.0 - 23.6.13\nVaadin 24.0.0 - 24.9.21\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\nVaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.22\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\nUpgrade the Spreadsheet add-on to 3.1.1\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.1.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.21 \u003e=24.9.22\ncom.vaadin:vaadin 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 \u003e=24.9.22\ncom.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 \u003e=3.1.1","modified":"2026-10-02T08:13:40.810539Z","published":"2026-09-30T13:13:13.074Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"3.1.1"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"Vaadin","cwe_ids":["CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93547.json"},"references":[{"type":"WEB","url":"https://maven.vaadin.com/vaadin-addons"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"WEB","url":"https://vaadin.com/security/cve-2026-93547"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93547.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93547"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/9905"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/9907"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/9908"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/9909"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/9910"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/9956"},{"type":"FIX","url":"https://github.com/vaadin/spreadsheet/pull/866"},{"type":"PACKAGE","url":"https://github.com/vaadin/flow-components"},{"type":"PACKAGE","url":"https://github.com/vaadin/platform"},{"type":"PACKAGE","url":"https://github.com/vaadin/spreadsheet"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vaadin/flow-components","events":[{"introduced":"fc0309382457a3595d4b766b40a57ccebca3b2c8"},{"fixed":"41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"introduced":"f86528dc71f22a535a8172fafca6fe128d3b89da"},{"fixed":"7e3951a1ef87880b6994dc69966c5969dd730c8a"},{"introduced":"ffc51a5b98b21f3a15191039050e9d8a8bf464cf"},{"fixed":"b2210855d02d7e09d2e4c2b27bfe4f3f0ce99ae3"},{"introduced":"2099b3c966835d8e2677c1d638bc3624ebbb8c87"},{"fixed":"47cf689e61827dc711be69dba6a9d8d04b74a375"},{"introduced":"2aa7290bdb7e8bff78ec91334627c2ed852539dc"},{"fixed":"8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18"}],"database_specific":{"extracted_events":[{"introduced":"23.1.0"},{"fixed":"23.6.14"},{"introduced":"24.0.0"},{"fixed":"24.9.22"},{"introduced":"24.10.0"},{"fixed":"24.10.10"},{"introduced":"25.0.0"},{"fixed":"25.1.12"},{"introduced":"25.2.0"},{"fixed":"25.2.7"}],"source":"AFFECTED_FIELD"}}],"versions":["24.10.9","25.2.6","25.2.5","25.2.4","24.10.8","25.2.3","25.2.2","25.2.1","25.2.0","24.10.7","24.10.6","24.10.5","24.10.4","24.10.3","24.10.2","24.10.1","24.10.0"],"database_specific":{"vanir_signatures":[{"digest":{"line_hashes":["139804014910014082595759955460233770290","157644513574755650845569825419532975039","13232134451527595369833234952243738595","336566875528174846137098077993175895057","43994750812215959662748770726165405120","85708241196083166070456182395835209029","224919112073548207090173162186740444094","327773519430404555652577262843872459845","55565235568084177155465310458437786532"],"threshold":0.9},"id":"CVE-2026-93547-01190b12","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/Icon.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["43510491227183790451322630924295846261","275312833198246850961003269078561136624","67295578828912037526655496466693582571","184082853300383203704105311043223456386"],"threshold":0.9},"id":"CVE-2026-93547-0941bbb3","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/GridSelectionColumn.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/GeneratedVaadinSplitLayout.java"},"deprecated":false,"digest":{"line_hashes":["337639349341496073403452413997753134055","182136995672750404607740388441871829705","197183611667140176443676879901914426301","64841229518222474182086907596992935989"],"threshold":0.9},"id":"CVE-2026-93547-10109631"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/VaadinItem.java"},"deprecated":false,"digest":{"line_hashes":["64045124586473418993041872196765760319","308804806241151468289307997172361938751","247198805478875923307778728005517095299","186734422492525047252513442279965703950"],"threshold":0.9},"id":"CVE-2026-93547-122bd724","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/TooltipConfiguration.java"},"deprecated":false,"digest":{"line_hashes":["11926996932901548406771578386876292593","219471549892987520333288078632757079546","218847027540348572831367480208694293592","161137083081090691540376690829134892574"],"threshold":0.9},"id":"CVE-2026-93547-13c71a50","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["288807544109764305603697632221890652535","87669936466187709514147407089959997451","176873081771583475227713670220193740817","283938057880133635805696002835834229712","155870715150561246077195289032981572172"],"threshold":0.9},"id":"CVE-2026-93547-16b4b062","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButtonGroup.java"}},{"deprecated":false,"digest":{"line_hashes":["264886082386068594597620973772576322653","339552908121151548546411364592179598734","316468174699773892762939957988915546083","270347554342506327407917489379903211551","299873406723067243495889307874406772659","253071116440112744627798904430161236320","209316402439564089791189399690490103587"],"threshold":0.9},"id":"CVE-2026-93547-173a2bfe","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinEmailField.java"}},{"deprecated":false,"digest":{"line_hashes":["65261207034701126607483489281406270662","14544999484550580017910451622633443926","331844193854727060947042346539745283940","253611163241845551610714254604715099783"],"threshold":0.9},"id":"CVE-2026-93547-18fa0bd8","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"}},{"target":{"file":"vaadin-map-flow-parent/vaadin-map-flow/src/main/java/com/vaadin/flow/component/map/Map.java"},"deprecated":false,"digest":{"line_hashes":["226718785279738169227864701510778095580","101124390178524459373447064230432030573","67873178327611045266091594984982033959","215616079332197731098993670623754149511"],"threshold":0.9},"id":"CVE-2026-93547-19e3fcc0","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"deprecated":false,"digest":{"line_hashes":["677117734493331432316145911839233197","160213264377640838067153238700837890490","328461641808303605742920323737810081743","284965866372647701917069165497983973834","188663203908123076233390873269441551587","309847126066467301921684163740419395755","258653698138359134022654877744521040729"],"threshold":0.9},"id":"CVE-2026-93547-1d345d98","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/HorizontalLayout.java"}},{"id":"CVE-2026-93547-208e7a58","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/AppLayout.java"},"deprecated":false,"digest":{"line_hashes":["339358128199368660449303409421260137716","50859895656435089643606463987027579135","85200415459428684127076359124480213873","121086627409195035758333466384665493163","196459052972410184312324334850447117093","146569395576243949732748963256078066650","188656282883376723791402694916328283116"],"threshold":0.9}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["191808895912370347516695747938319400166","278464140399482312505247196505016597059","37831724787940896097335978412173181952","228042695521773983100669147966890801639","175791325826089812110533623204205660138","289634322657346398850163851324953878559","186806798073385807651842146375817809752"]},"id":"CVE-2026-93547-2096dbf0","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormLayout.java"}},{"digest":{"line_hashes":["176462570933424815658047137258311676296","11804231312275787404598469476240772286","237064518287325444808860864105251146283","12113835077192690950412275839293301343","227143884354788317902376880792080660055","331729605430946958981696168837120931667","68203389204870834201746409303363081660"],"threshold":0.9},"id":"CVE-2026-93547-20ec64d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-date-picker-flow-parent/vaadin-date-picker-flow/src/main/java/com/vaadin/flow/component/datepicker/GeneratedVaadinDatePicker.java"},"deprecated":false},{"id":"CVE-2026-93547-22c795a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java"},"deprecated":false,"digest":{"line_hashes":["187878492917358939303207349002436227632","65183619752008960595600515257969025756","175348754033651330298254900868356312679","217492588439935987009082552984441764973","122931687290364272819553630118007984411","5266620351163651567050367023060434760","114360412769718866045781607393166974270","232090047897335170397444635575195210234","240218483270638901428053521174419739162","245107801072664225405818235226806557965","90637910651623701523977683918065105063"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-material-theme-flow-parent/vaadin-material-theme-flow/src/main/java/com/vaadin/flow/theme/material/Material.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["319335563772636922441838168443882415880","191962149090652637672230472863835465396","273814512111863790569336450491072506349","210181994341964362488474114937120362408","311035585269293114669641902533751291582","239773814596530463941231860871776105213","129150706120547662184561353077942454000"]},"id":"CVE-2026-93547-22d5fc43"},{"id":"CVE-2026-93547-24ccc3c1","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTab.java"},"deprecated":false,"digest":{"line_hashes":["57576137265725683361030683898059436241","9784372319100683215754767622511098744","222370475748735533613936567000048990526","232195050182601260754401940854787409012","188821404639721968343183224743250648857","130881945820937367369054854758540490301","26847135543689638393775422567550366837","239494238228205856391532309480088524931"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["310723032833634798599800289931119409211","2099159557420148499595097462776673552","20513334240292002585711973050871101636","193806335394942766725414533603392981548"],"threshold":0.9},"id":"CVE-2026-93547-26e7e923","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/Tooltip.java"}},{"digest":{"line_hashes":["319886305313204774108013156926536192936","150395070036305921884131467670221598048","102123083932101903230031242085604588729","163032960490188177649277847772543802850"],"threshold":0.9},"id":"CVE-2026-93547-2876c428","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioButton.java"},"deprecated":false},{"id":"CVE-2026-93547-34f3ae52","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-custom-field-flow-parent/vaadin-custom-field-flow/src/main/java/com/vaadin/flow/component/customfield/CustomField.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["115741627196033955352740076878494525557","12090350657536638073904665362396528545","101705517318127877902703184183789934088","152233282415911041010281959552727861777","193456814348297137911212479072491760205","109723050929774491613756726796354669932","33016324394107199248712789547205850548"]}},{"target":{"file":"vaadin-lumo-theme-flow-parent/vaadin-lumo-theme-flow/src/main/java/com/vaadin/flow/theme/lumo/Lumo.java"},"deprecated":false,"digest":{"line_hashes":["319335563772636922441838168443882415880","191962149090652637672230472863835465396","273814512111863790569336450491072506349","68207926509279664122118898628473381260","187435772876896398444433897018940467589","177931250631534213142782163970362183460","29038517509170570206558330634759579926"],"threshold":0.9},"id":"CVE-2026-93547-3a740919","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"digest":{"line_hashes":["148894924585365974642268941180823793989","205122796566615840020368803338149832688","4594601767935482560184412717222600337","51636861566931085158666783594938852877","252244327282403336485088762507028891446","31011048963010996575177804786949457232","3739999029154109081550460632421053991","293094725849694205411446862249340624511"],"threshold":0.9},"id":"CVE-2026-93547-3b35e291","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-virtual-list-flow-parent/vaadin-virtual-list-flow/src/main/java/com/vaadin/flow/component/virtuallist/VirtualList.java"},"deprecated":false},{"id":"CVE-2026-93547-3dc25619","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java","function":"setEnabled"},"deprecated":false,"digest":{"length":124,"function_hash":"94215097563696518968142770020851707059"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-menu-bar-flow-parent/vaadin-menu-bar-flow/src/main/java/com/vaadin/flow/component/menubar/MenuBar.java"},"deprecated":false,"digest":{"line_hashes":["122214457292668270259616897966086856158","284868926174609364283242610964408704958","308579315570955473166196606396787837945","118863128363336726872649250392810598406","157713642203272456630450319704120225619","304954206707355744734948918909963245779","188628152124315505580886960743122661810","263562954493957973610699789735507356530","259532268690019241572784185038585407478","190616727812425483973702406763497022507","140960119378718788711635754128476173336"],"threshold":0.9},"id":"CVE-2026-93547-41805a19","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/generated/GeneratedVaadinSelect.java"},"deprecated":false,"digest":{"line_hashes":["125542708423254180184490501726435776211","285326487856755650705580980438075886426","252093910142031954120233202640959430170","145179201001583151611475073460071351655","71044882135712510871477415856482053537","95216166418836703016698099765570302407","199285825967559726837200400213781854275"],"threshold":0.9},"id":"CVE-2026-93547-454d38b6","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["165968137833737408160637340064193260666","214569625351503208711812290184090583754","235949935109141752180416121379180788889","91103122562431492031006384456842969936","71309471997345684108042794883609122409","12315998428467556154894715146980870935","96165518297190150486800625269449151755"],"threshold":0.9},"id":"CVE-2026-93547-47c9b081","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/AccordionPanel.java"}},{"target":{"file":"vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/ProgressBar.java"},"deprecated":false,"digest":{"line_hashes":["29143086595964715638679839335964555436","197484545637239969173300077852872208166","12901518315434289807934191433575620395","256085568011290674787323188557374733153","166584884665947565823818159338178777040"],"threshold":0.9},"id":"CVE-2026-93547-4c325123","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"source":"https://github.com/vaadin/flow-components/commit/7e3951a1ef87880b6994dc69966c5969dd730c8a","target":{"function":"updateCellComment","file":"vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/SpreadsheetHandlerImpl.java"},"deprecated":false,"digest":{"function_hash":"134128486111753383408977196812965987078","length":621},"id":"CVE-2026-93547-4c7a5c87","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["15698723147241475930750619660506166978","128555961472113491233200122454670790249","115274807142504644087023868638950057113","277457619339576881844385343413258133001"],"threshold":0.9},"id":"CVE-2026-93547-501651f8","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/ColumnGroup.java"}},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-select-flow-parent/vaadin-select-flow/src/main/java/com/vaadin/flow/component/select/Select.java"},"deprecated":false,"digest":{"line_hashes":["161789032417775497927028249718519807782","295188965970819343385963683081255486952","42933334843854916521104866664477727922","3216241012338932786639023110765854070"],"threshold":0.9},"id":"CVE-2026-93547-50bd679f","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-date-time-picker-flow-parent/vaadin-date-time-picker-flow/src/main/java/com/vaadin/flow/component/datetimepicker/DateTimePicker.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["109099308319594873921528275837220308588","142429247337826247633249731870136759958","233775504849881222799801841540070473483","165119053358499097601623809758969847530","243196388267204202737234894496400276847","89764715898966822222390877389766815997","253855398323365199244936792947038376290","273556940925835595189723640177595251671","115660092913163023514208615922277110685","11494545405891050460251534424069639681","83058234698690279094721657936699160665","157307893810061268982960113253866788728","41321985310312895987871303574956775995","139743062104737638620488794851827925099","78486513658984066616140717383883970104"]},"id":"CVE-2026-93547-516a39f5","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-dialog-flow-parent/vaadin-dialog-flow/src/main/java/com/vaadin/flow/component/dialog/GeneratedVaadinDialog.java"},"deprecated":false,"digest":{"line_hashes":["300826378304734914384370620371318123410","109355843476382320286417959182311815101","239926748279198558638184990052482578327","29406460051694085704676060758007442464","152546706606826330494638609122572832129","163410448430256130578429428470909854319","193753302363044114337060192692555588050"],"threshold":0.9},"id":"CVE-2026-93547-52fb2146","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-confirm-dialog-flow-parent/vaadin-confirm-dialog-flow/src/main/java/com/vaadin/flow/component/confirmdialog/ConfirmDialog.java"},"deprecated":false,"digest":{"line_hashes":["23915464060710696087093548938400709203","296891493060618395130466698131365893180","221679676065858660553951247086586331214","272240179496748985686775716627170322054","252757338102080358672145075646818532343","91569646472235957676549351189222665045","227048749957502766678637860274872565139"],"threshold":0.9},"id":"CVE-2026-93547-5efba4f1","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-crud-flow-parent/vaadin-crud-flow/src/main/java/com/vaadin/flow/component/crud/Crud.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["331695949661642704054358543676425196993","130082900393848411472914659772066510704","278654718638579125009443920264070020237","103105773234313912841403200130872626900","68680838279358822913179183397277559126","22794154688379504767843814072194529010","243375664151456322202188921250557969544"]},"id":"CVE-2026-93547-62f98fe3","signature_type":"Line"},{"digest":{"line_hashes":["133692119156590038724960648503878388387","128799939694515685140101245758848655362","66895408611146281818575319932888804466","297761285997344584033497421090789238355","91047348625361866104586324859834302900","222640208638284573934082880350817430565","231257574783938170895854250570117476448","193891923162156337782198482712842965396","231641059062251897602530987003028083978","198462424370723068282635268499212359372","213046146385460822868339206060287575225","22908424730610608225943025312239326876"],"threshold":0.9},"id":"CVE-2026-93547-64f780c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/grid/Grid.java"},"deprecated":false},{"digest":{"line_hashes":["10695398993901130126524256648111426756","71088825340520715117035264342596952622","298121506233416827925719370144078121969","265902173811208154901801579954188507255","79950434984058930922753047753947397395","15525473410893240237817433022336524429","251051406288606960212531596126689067364","142566843632775685958365403892440461981"],"threshold":0.9},"id":"CVE-2026-93547-651c9911","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageInput.java"},"deprecated":false},{"id":"CVE-2026-93547-683a3c4d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginOverlay.java"},"deprecated":false,"digest":{"line_hashes":["22608943814735554080260452743789021849","255672148858980605281042921763497852876","297307368075890483644630176272712766374","11992029449152443567309608112944314266","303845321096730943506688281587233179176","109383799550672341692102976450407950532","257160395088732415267496068560189532121"],"threshold":0.9}},{"id":"CVE-2026-93547-684fa8db","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-login-flow-parent/vaadin-login-flow/src/main/java/com/vaadin/flow/component/login/LoginForm.java"},"deprecated":false,"digest":{"line_hashes":["37954593981273224711651226117012275374","50029570256929089570759330400766271728","49509070851887386787907590323123065782","11992029449152443567309608112944314266","134392995199879721010538339736372947234","88623736752635021964856203766557704040","167635133703589878233420053367415801339"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["241689171885620782826981589845663004777","299616126575864573876546891671612518081","54830249824303220446958746624092296859","263782993191051094061743760653308064638"],"threshold":0.9},"id":"CVE-2026-93547-6daccd77","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/BigDecimalField.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/7e3951a1ef87880b6994dc69966c5969dd730c8a","target":{"file":"vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/SpreadsheetHandlerImpl.java"},"deprecated":false,"digest":{"line_hashes":["256787771069965889313325252634824664212","124813820570030010825344953833040043683","209834052222992558832033990883029798149","70339247302726660819422390398699956562"],"threshold":0.9},"id":"CVE-2026-93547-6f36f3db"},{"id":"CVE-2026-93547-6ffc2a03","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-icons-flow-parent/vaadin-icons-flow/src/main/java/com/vaadin/flow/component/icon/IronIcon.java"},"deprecated":false,"digest":{"line_hashes":["334233500371833792753575364112259844628","284153417450888717578420138615768288735","188485950816725313378128281625837796446","114402648547973463757447937287298547284"],"threshold":0.9}},{"id":"CVE-2026-93547-723e8ccb","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/TabSheet.java"},"deprecated":false,"digest":{"line_hashes":["218862919199480754051629337260538835454","124951472782991165983569559182773423930","12404004292233203819400791899139090814","176168551134820289968728650782907125546"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["165514547439980300028062992971534138879","197736796814260515462926292968769301795","28567907427771622444594021055117702644","121086627409195035758333466384665493163","100692717951015748919787003728740983249","208842102433802380174781413921072434269","106793714606155189369913400520341547072"],"threshold":0.9},"id":"CVE-2026-93547-72def470","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-app-layout-flow-parent/vaadin-app-layout-flow/src/main/java/com/vaadin/flow/component/applayout/DrawerToggle.java"}},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/VaadinItem.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["9486403756278168829181911628021249626","104356880514060629591554550210751516088","133007495947680000070408269365694609962","12743654030765929263470535305973498692","139196424454802799599119657153757607969","327674210378814045462636197031106408964","256410201959885610488855575299852273346"]},"id":"CVE-2026-93547-73018cd9","signature_type":"Line","signature_version":"v1"},{"target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextField.java"},"deprecated":false,"digest":{"line_hashes":["296134014643193894687108216620192861202","150076420155488188747186365406386646575","58308549095909287863561501069992775605","218467119670865233717677283628302079794","91605728170722333859935741182843980187","325101047337923583092387400877391856847","27185662108624818765404783584005661541"],"threshold":0.9},"id":"CVE-2026-93547-7679858d","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-split-layout-flow-parent/vaadin-split-layout-flow/src/main/java/com/vaadin/flow/component/splitlayout/SplitLayout.java"},"deprecated":false,"digest":{"line_hashes":["64226170934336236073007597738702317760","207424279715551666644601135288349175006","191537745693800899161546529704068355154","289564311499018879947485301797170874731","66809657976619777237557298512259981855"],"threshold":0.9},"id":"CVE-2026-93547-890ee491","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/Scroller.java"},"deprecated":false,"digest":{"line_hashes":["17139459073066948577597065442463722733","238370078926877545422041364937098904025","242993266706821184277991774083634041766","332292535226721593041079559061372192472","29073209658698636902063524831228222573","7064186056011437102597373108829099942","271167879179362872872949303908286764581"],"threshold":0.9},"id":"CVE-2026-93547-8d23ec31","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/RadioButton.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["318169978420655560834861458604140627385","201241979948086642080975612603467551591","289006815259786259767173033557327588764","3035670795667065395203864972851072781","184716445595699671364714982228250106602"]},"id":"CVE-2026-93547-8fde8059","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/IntegerField.java"},"deprecated":false,"digest":{"line_hashes":["286129081824461912373386685418830838504","122696600537683304201517824359619617954","331499159739763707425498094410591953275","93010352653554887474572428483108300692","296135578515743027946389472736410346002","335302875285392095343386765465369235547","263894116202172533101595019824822189903"],"threshold":0.9},"id":"CVE-2026-93547-937005e9","signature_type":"Line"},{"target":{"file":"vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/RichTextEditor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["263932228569716878028493654794287555373","251520267803906853601443427278291596190","113351744021313239603160655734773573898","160416262712267843847167610626014510564"]},"id":"CVE-2026-93547-93f309b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"digest":{"line_hashes":["151861268607778617528442703297741355291","62997444179922146649000533830357941312","41933201836200407367609330097471767646","172001675943777915675869389875081093441","289971105651836865924670331962781488329","194788201666869751516466351063789372735","186998710628045208448839329807664559585"],"threshold":0.9},"id":"CVE-2026-93547-96ceb930","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-cookie-consent-flow-parent/vaadin-cookie-consent-flow/src/main/java/com/vaadin/flow/component/cookieconsent/CookieConsent.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/MultiSelectComboBox.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["270064432359579580076235852296308999471","31297989078224108306026391392933587062","193640368209559062201530548907812445381","47349015229353814134605922319423142611","31780099556070361462176726419774538502","53467278015159944524510335949254227670"]},"id":"CVE-2026-93547-981b9b72"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-details-flow-parent/vaadin-details-flow/src/main/java/com/vaadin/flow/component/details/Details.java"},"deprecated":false,"digest":{"line_hashes":["188955872903654492216388914638133212854","96067614133234538814144289917933158223","15792975074872021262673902516588493961","212861641974843638425040798069764743113","48435976830759833605795897185317759421","25807009063683446370478853981472653538","255002618588899229101184740783834607058"],"threshold":0.9},"id":"CVE-2026-93547-995ab1d9","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["3747459429878414448462577926462842449","218524146567427119372410935870638425896","143859476620716492677025939397642586699","193347563249656837090940636136910768252"],"threshold":0.9},"id":"CVE-2026-93547-a02bb5fa","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUploadFile.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"function":"setEnabled","file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/Button.java"},"deprecated":false,"digest":{"length":123,"function_hash":"8186637721138874716787329503259068574"},"id":"CVE-2026-93547-a2ba85e2"},{"id":"CVE-2026-93547-a406f317","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinTextArea.java"},"deprecated":false,"digest":{"line_hashes":["21227522182542128695877441772043364054","280232788834897151624455764562425060218","326802776617848061725822318490912768969","124621194736784945557835360886083322751","176350313577864214163874374920187502319","107149033961027880252532211751204042686","151504935647717589128606775739355363416"],"threshold":0.9}},{"id":"CVE-2026-93547-a52931f4","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Board.java"},"deprecated":false,"digest":{"line_hashes":["110884903166894414314094557662559942039","206630681242459063977873026595980177567","38500256514598055381437606712815889267","273309716519723668405782285685164996321","284309102270475709302381221947756978119","8916090830652495843285792880063796135","170452268445978674027321881128146511287"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-combo-box-flow-parent/vaadin-combo-box-flow/src/main/java/com/vaadin/flow/component/combobox/ComboBox.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["331840309606413920329566731680531077261","325775648053078910998965466605552940276","188513189907641937520674316385079768433","303556764474508714310000007550364481805","98312673574687481808221658700288328207","325450817363175960243334315341871449741","128656164862467941083431583963133406895"]},"id":"CVE-2026-93547-a7efa864","signature_type":"Line"},{"target":{"file":"vaadin-progress-bar-flow-parent/vaadin-progress-bar-flow/src/main/java/com/vaadin/flow/component/progressbar/GeneratedVaadinProgressBar.java"},"deprecated":false,"digest":{"line_hashes":["302266890798810844425583005350020712785","20653944505422516373720386232501031556","47268719125627302469474966406424366815","203545127554392161980370111385127632494"],"threshold":0.9},"id":"CVE-2026-93547-a9b8cb03","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/Avatar.java"},"deprecated":false,"digest":{"line_hashes":["35042164962131879423852798472665158984","334338804907630990117763142230653398557","152085211708504497443025724518187746021","313393773274946483677080789133281606609","34275494161687850458375209920254636276","41417433753614015572062946356799612718","84329100855289328211950208530206453166","85313434810737355423842705408109276654"],"threshold":0.9},"id":"CVE-2026-93547-ad365234","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-button-flow-parent/vaadin-button-flow/src/main/java/com/vaadin/flow/component/button/GeneratedVaadinButton.java"},"deprecated":false,"digest":{"line_hashes":["290602405391722824758593884556281563324","45562812048430893566786838410913597554","95962027479079802825658536394088414982","74378206895964183901043479553977895861","302652901202117598265292436594201667966","246395884098897398283115628236714287501","68574240783192397774013611505769785725"],"threshold":0.9},"id":"CVE-2026-93547-afbb6094"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["157618035939260416624303900298176598989","301373085352754471481466939801004927416","209047635362721052828370708416842238722","57149809821657081314195817723156614097","17020392855735474254904159052154397284","276226431468771808046151862758969302532","44173318426708978767428596523017735001","75385984258550474494979230331427111655","44577620567949090085282011164139043283","291006460486519518492116388394468770274","192777481132803751958892886508463001286","188278385786347862102741975298703166764","132795863756969832695605223751728329676","190383862081031616478265877132169662280","299607987853524260189308996789227812560","137747352174428328055239541980395793306","337991211691687789478692762572733787919","20852170086004971186537977360973695699","321096966137212934089768556273678824177","331225987917223565639750072257625483771","33418372602960645112421985380394916565","43921841694542266475714577875484314694","101964898985507069036018755971491519274"],"threshold":0.9},"id":"CVE-2026-93547-b071f503"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-messages-flow-parent/vaadin-messages-flow/src/main/java/com/vaadin/flow/component/messages/MessageList.java"},"deprecated":false,"digest":{"line_hashes":["264810375198202281052237583333885872748","120330610410566778273474244514535347597","126691195870628948406246533844756236586","59899086060179810590802816856019812605","160831976443012732529543374476821988804","219787878045153420824300055572897279452","308194455916845101429284089933925160619","247534912660287641774070804226394957948","191151246788996757670849488782924154784"],"threshold":0.9},"id":"CVE-2026-93547-b08c1a0a"},{"deprecated":false,"digest":{"line_hashes":["127403949388793812751790920998532279342","171271229392313362031687611679415814400","274559978183589632573428361096790644816","262512437039626970798085267630357462772"],"threshold":0.9},"id":"CVE-2026-93547-b0e12764","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-time-picker-flow-parent/vaadin-time-picker-flow/src/main/java/com/vaadin/flow/component/timepicker/GeneratedVaadinTimePicker.java"},"deprecated":false,"digest":{"line_hashes":["36014278876800646412415183710643565081","69805889774702802594681815102630197897","265337545633700122557546308763505064160","333730949719838316842232000309093880656","329683297791299968690113918906685090906","156478663263092608479511778792929503684","337269462531029046172730568955292921695"],"threshold":0.9},"id":"CVE-2026-93547-b23545fa"},{"target":{"file":"vaadin-tabs-flow-parent/vaadin-tabs-flow/src/main/java/com/vaadin/flow/component/tabs/GeneratedVaadinTabs.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["249026093832844837766830785197691709380","227912246111322214563542748846531056106","151336125913051794608279045107913018923","321317797643847083961534643390412351720","207249037672481594696392284328317296460","185433344719776604986282149734971586258","52444827414347959589929221579200508955","285084676521978198077518627414966803100"]},"id":"CVE-2026-93547-b2751482","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-charts-flow-parent/vaadin-charts-flow/src/main/java/com/vaadin/flow/component/charts/Chart.java"},"deprecated":false,"digest":{"line_hashes":["166991970097207763098882341709530345157","99643428964889711427624689777016277716","36002910287982724568136914702364550851","35735164940356661782080437227165139322","199250534797027582648617535250989794050","255367305213772629138460332344838658936","82095094985122493580687082607073149202"],"threshold":0.9},"id":"CVE-2026-93547-b5a4073f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["149286409461437386191953540480133784087","49893343540222275457444686606027682991","249811514533215902220728379827826410075","91103122562431492031006384456842969936","121962156312976409413971193791180840985","73118177241664850946307267252691107143","174667181549613192901529913923084661747"],"threshold":0.9},"id":"CVE-2026-93547-b64fc7a5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-accordion-flow-parent/vaadin-accordion-flow/src/main/java/com/vaadin/flow/component/accordion/Accordion.java"}},{"source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinPasswordField.java"},"deprecated":false,"digest":{"line_hashes":["16737564262995772171574308722993530448","321044719298573500035259504410505310738","288899636742328523412543577990877804921","15212173775034213636395645419930287312","282523647538093995213764344493402038067","15443124746952533375991441029749541526","37014539976917280432164335953063216599"],"threshold":0.9},"id":"CVE-2026-93547-b8656437","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-93547-ba908aa9","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java","function":"DisableOnClickController"},"deprecated":false,"digest":{"function_hash":"65313709292149367055722205061676845717","length":209}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckbox.java"},"deprecated":false,"digest":{"line_hashes":["133649201688321882713428026178444800203","161460649361402428975023761658687440207","37471200067585969808876757234530854469","132151675085800208527943916776512595085","78599188599561770387804248239393072746","240484443808672308446145218953409535267","77976230274680133791950358573498791613"],"threshold":0.9},"id":"CVE-2026-93547-bbaf49db","signature_type":"Line"},{"target":{"file":"vaadin-text-field-flow-parent/vaadin-text-field-flow/src/main/java/com/vaadin/flow/component/textfield/GeneratedVaadinNumberField.java"},"deprecated":false,"digest":{"line_hashes":["318733234789774818013650823559243686166","155467279564625194386739517009555657317","200820764168340039774082095617125422829","20638871805355232654075664399420613093","182700517214039798156823143991123182341","232486954604430196409508624601680190471","95009472817351924470363736855953106800"],"threshold":0.9},"id":"CVE-2026-93547-c05f9a84","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"id":"CVE-2026-93547-c2c77763","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-notification-flow-parent/vaadin-notification-flow/src/main/java/com/vaadin/flow/component/notification/GeneratedVaadinNotification.java"},"deprecated":false,"digest":{"line_hashes":["10211340479860090629743656628918047453","197197139648245230132094037020417659335","281093077021474695394089753112861441455","239024325104691876018229511024783319125","246974244694991156405771888586260879867","118128784499318994019221069580147163366","36586547179933324992191329955906359525"],"threshold":0.9}},{"target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java"},"deprecated":false,"digest":{"line_hashes":["177730825871372786675754190791750619927","338936118145022616229490874091614496760","327292825193664473580486174633809916476","253611163241845551610714254604715099783"],"threshold":0.9},"id":"CVE-2026-93547-c416fc59","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18"},{"deprecated":false,"digest":{"line_hashes":["3342279977513093176970665938915846120","239833703289252027300793526605021379528","144933193019561968988947999866286125408","208725067024108974578700960554391822699","229386877056697493603325186648549003887","41249130166745236839110125269494868487","316678280554179526858592193552217055253"],"threshold":0.9},"id":"CVE-2026-93547-c59b41fc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-checkbox-flow-parent/vaadin-checkbox-flow/src/main/java/com/vaadin/flow/component/checkbox/GeneratedVaadinCheckboxGroup.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-avatar-flow-parent/vaadin-avatar-flow/src/main/java/com/vaadin/flow/component/avatar/AvatarGroup.java"},"deprecated":false,"digest":{"line_hashes":["183669286758542800120904956231759528192","205429302556979600339439108756404100555","235534367202262392586638265760869078284","319249785718410059994689155645158242832","210330053413338236976855956759378309607","110111601403662786138931812398206680516","156415189788446967557805847297882099586","201473658986729545135508816026288167087"],"threshold":0.9},"id":"CVE-2026-93547-c7840414","signature_type":"Line"},{"source":"https://github.com/vaadin/flow-components/commit/7e3951a1ef87880b6994dc69966c5969dd730c8a","target":{"file":"vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/test/java/com/vaadin/flow/component/spreadsheet/tests/LockedCellValueTest.java"},"deprecated":false,"digest":{"line_hashes":["33751207731177279916778847055267313217","227133732382369820561550942476389327373","85372190767816552678888493140283774602"],"threshold":0.9},"id":"CVE-2026-93547-c7ad7e9f","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/main/java/com/vaadin/flow/component/shared/internal/DisableOnClickController.java","function":"onSetEnabled"},"deprecated":false,"digest":{"function_hash":"121197145329376912083425646820988589471","length":107},"id":"CVE-2026-93547-ceac5666"},{"deprecated":false,"digest":{"line_hashes":["192923233484013268518831943021142354284","157876665848436088383765916788720493587","55824247868731363346765442643881428274","335767160086616160531986363660508886149"],"threshold":0.9},"id":"CVE-2026-93547-d10a1ac6","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-radio-button-flow-parent/vaadin-radio-button-flow/src/main/java/com/vaadin/flow/component/radiobutton/GeneratedVaadinRadioGroup.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"function":"setup","file":"vaadin-flow-components-shared-parent/vaadin-flow-components-base/src/test/java/com/vaadin/flow/component/shared/DisableOnClickControllerTest.java"},"deprecated":false,"digest":{"length":53,"function_hash":"89590505678001962171649155691520374787"},"id":"CVE-2026-93547-d12f6b4c"},{"digest":{"line_hashes":["260747726235634794993902707479722896541","274803150691726496786879479267409702927","254889689084794453491094603592138581027","261080555089734841723742780926909350014","167196598393875690145642349052954543126","129034739790214737723583443118181997222","138704386736152255969783093637196845325"],"threshold":0.9},"id":"CVE-2026-93547-d50a2f7b","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-rich-text-editor-flow-parent/vaadin-rich-text-editor-flow/src/main/java/com/vaadin/flow/component/richtexteditor/GeneratedVaadinRichTextEditor.java"},"deprecated":false},{"target":{"file":"vaadin-form-layout-flow-parent/vaadin-form-layout-flow/src/main/java/com/vaadin/flow/component/formlayout/GeneratedVaadinFormItem.java"},"deprecated":false,"digest":{"line_hashes":["184820732948850618140671532857375926357","270109894138226848586803395009304662431","254284928612152137228660671993137850075","228042695521773983100669147966890801639","237985893107015460913338252594878977361","8707089422255774151057341133518027958","160675206649894703226676680386500833910"],"threshold":0.9},"id":"CVE-2026-93547-d80cf431","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"},{"deprecated":false,"digest":{"line_hashes":["147669706542717616439282489690739247534","174352132234405669341520822581396995963","144041428412646472414677686290797476085","91678603034938714167609422266820857069","175482217806722228465822415951516733884","278989618549371147626777820408916959827","61900266636437648613916898349232198225"],"threshold":0.9},"id":"CVE-2026-93547-dc0db0d6","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/GeneratedVaadinContextMenu.java"}},{"deprecated":false,"digest":{"line_hashes":["192296712265805911827465241878700714450","85160900996113503128956864962449100955","123033110637364046102402564600393040007","14724920941767003978379020292356879963","328168190565018123612562488294530931178","252822266523987084777592728934114258675","99509896750817620317110092883861233837","139430338815560722677403032253587117292","89682221290037726859613428174823396368","265587249170633488161134699313542747946","183342365252072769986093456072442539639"],"threshold":0.9},"id":"CVE-2026-93547-e1d50fb5","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-grid-pro-flow-parent/vaadin-grid-pro-flow/src/main/java/com/vaadin/flow/component/gridpro/GridPro.java"}},{"id":"CVE-2026-93547-e8dcbcd7","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-upload-flow-parent/vaadin-upload-flow/src/main/java/com/vaadin/flow/component/upload/GeneratedVaadinUpload.java"},"deprecated":false,"digest":{"line_hashes":["236365180443322534775786162807195468276","73881263462528490227162792187723418805","335050402150907510262695574844648875798","76039225499072543023272505724714802083","211426072065987685837483016118859488123","333048899618785237785388157062487563456","307531424693958850275883946342086837797"],"threshold":0.9}},{"id":"CVE-2026-93547-ecc391cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-field-highlighter-flow-parent/vaadin-field-highlighter-flow/src/main/java/com/vaadin/flow/component/fieldhighlighter/FieldHighlighterInitializer.java"},"deprecated":false,"digest":{"line_hashes":["248330057012495454487572247953246174461","180204442388735139397723466421837262401","297080339719520426227060288276558130611","306303978961281584570462686019620492582"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["12448788347901060262680827741367619739","18698722509563948865487027471465110243","250584031738477184849124641692573647288","35449937819355197211247567518570563980","314800432085723460941030117780871019998","111597249665721741040264613142628794680","270926575980090071813408269729816966497"],"threshold":0.9},"id":"CVE-2026-93547-f2cd9c6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-ordered-layout-flow-parent/vaadin-ordered-layout-flow/src/main/java/com/vaadin/flow/component/orderedlayout/VerticalLayout.java"}},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18","target":{"file":"vaadin-context-menu-flow-parent/vaadin-context-menu-flow/src/main/java/com/vaadin/flow/component/contextmenu/MenuItemBase.java","function":"setEnabled"},"deprecated":false,"digest":{"length":127,"function_hash":"289850733904819289915873124456125618015"},"id":"CVE-2026-93547-f3a90ee6","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74","target":{"file":"vaadin-list-box-flow-parent/vaadin-list-box-flow/src/main/java/com/vaadin/flow/component/listbox/ListBoxBase.java"},"deprecated":false,"digest":{"line_hashes":["240382149252733595752779577296411855969","101772293080948172956170602989154569763","135227480374018299140246201256205472469","197828055984619559121822908012482629926","107615839872240406063989613637478037708","113496577171116847709610927543347904960","55989134884685624414937857417269361306"],"threshold":0.9},"id":"CVE-2026-93547-f41d784f"},{"target":{"file":"vaadin-board-flow-parent/vaadin-board-flow/src/main/java/com/vaadin/flow/component/board/Row.java"},"deprecated":false,"digest":{"line_hashes":["308665252251722873145388895931131189129","186037273815994831668880381707926035942","126263078102742853744189393412346687853","273309716519723668405782285685164996321","134186575095070449518200754652098371651","231592589758450559982797079486843689318","263600285041018052271331378962137191860"],"threshold":0.9},"id":"CVE-2026-93547-f63daa53","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/41da1428d6c458919f7effaeca8b8317d2d1bc74"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93547.json","vanir_signatures_modified":"2026-10-02T08:13:40Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}