Login Request a demo
A2
Product
a2a-java
by a2aproject · last CVE Oct 27, 2026
11
CVEs
0
On KEV
7.5
Max CVSS
9
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 0High 3Medium 8Low 0
Severity
All severities11Critical0High3Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add a2a-java to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-111761
5.8
1%
Oct 20
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
Affected: < 1.3.0.Final
CVE-2026-111763
5.7
0%
Oct 20
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
Affected: < 1.3.0.Final
CVE-2026-111762
5.7
0%
Oct 20
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
Affected: < 1.3.0.Final
CVE-2026-117507
New
5.4–Oct 27
a2aproject a2a-java TaskManager.saveTaskEvent race condition
Affected: 1.2.0.Final
CVE-2026-117506
New
4.3–Oct 27
a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
Affected: 1.2.0.Final
CVE-2026-117505
New
4.3–Oct 27
a2aproject a2a-java ChildQueue queue.offer resource consumption
Affected: 1.2.0.Final
CVE-2026-116479
New
4.3
0%
Oct 26
a2aproject a2a-java JSON-RPC Error getMessage information exposure
Affected: 1.2.0.Final
CVE-2026-90820
4.3
0%
Sep 14
a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization
Affected: 1.2.0
Showing 8