Login Request a demo
A2
Product
a2a-java
by a2aproject · last CVE Oct 27, 2026
11
CVEs
0
On KEV
7.5
Max CVSS
9
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 0High 3Medium 8Low 0
Severity
All severities11Critical0High3Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add a2a-java to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-111765
7.5
1%
Oct 20
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
Affected: >= 1.3.0.Final, < 1.3.2.Final
CVE-2026-111764
7.5
1%
Oct 20
A2A Java SDK has a fail-open default task authorization
Affected: < 1.3.0.Final
CVE-2026-90819
7.3
1%
Sep 14
a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting
Affected: 1.2.0
Showing 3