A2
Vendor
a2aproject
22
CVEs
0
On KEV
19
New 30D
Products
A27.5
a2a-java
a2aproject
11 CVEs0 on KEV9 new
A27.3
a2a-rs
a2aproject
4 CVEs0 on KEV4 new
A25.3
a2a-go
a2aproject
3 CVEs0 on KEV3 new
A25.4
a2a-dotnet
a2aproject
2 CVEs0 on KEV2 new
A26.5
a2a-js
a2aproject
1 CVEs0 on KEV1 new
A26.3
a2a-python
a2aproject
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118128 New | A2 a2a-js a2aproject | 6.5 | Oct 27 | a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition |
| CVE-2026-117507 New | A2 a2a-java a2aproject | 5.4 | Oct 27 | a2aproject a2a-java TaskManager.saveTaskEvent race condition |
| CVE-2026-117506 New | A2 a2a-java a2aproject | 4.3 | Oct 27 | a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption |
| CVE-2026-117505 New | A2 a2a-java a2aproject | 4.3 | Oct 27 | a2aproject a2a-java ChildQueue queue.offer resource consumption |
| CVE-2026-117504 New | A2 a2a-go a2aproject | 5.3 | Oct 27 | a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service |
| CVE-2026-117503 New | A2 a2a-go a2aproject | 5.3 | Oct 27 | a2aproject a2a-go REST SSE handler rest.go resource consumption |
| CVE-2026-116479 New | A2 a2a-java a2aproject | 4.3 | Oct 26 | a2aproject a2a-java JSON-RPC Error getMessage information exposure |
| CVE-2026-116478 New | A2 a2a-go a2aproject | 5.3 | Oct 26 | a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure |
| CVE-2026-116477 New | A2 a2a-dotnet a2aproject | 4.3 | Oct 26 | a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure |
| CVE-2026-116476 New | A2 a2a-dotnet a2aproject | 5.4 | Oct 26 | a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition |
| CVE-2026-113707 | A2 a2a-rs a2aproject | 5.4 | Oct 20 | a2aproject a2a-rs inmemory.rs update race condition |
| CVE-2026-113706 | A2 a2a-rs a2aproject | 3.5 | Oct 20 | a2aproject a2a-rs inmemory.rs information disclosure |
| CVE-2026-113705 | A2 a2a-rs a2aproject | 5.3 | Oct 20 | a2aproject a2a-rs error.rs information exposure |
| CVE-2026-113704 | A2 a2a-rs a2aproject | 7.3 | Oct 20 | a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery |
| CVE-2026-111765 | A2 a2a-java a2aproject | 7.5 | Oct 20 | A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix |
| CVE-2026-111764 | A2 a2a-java a2aproject | 7.5 | Oct 20 | A2A Java SDK has a fail-open default task authorization |
| CVE-2026-111763 | A2 a2a-java a2aproject | 5.7 | Oct 20 | A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect |
| CVE-2026-111762 | A2 a2a-java a2aproject | 5.7 | Oct 20 | A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure |
| CVE-2026-111761 | A2 a2a-java a2aproject | 5.8 | Oct 20 | A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery |
| CVE-2026-90820 | A2 a2a-java a2aproject | 4.3 | Sep 14 | a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization |
| CVE-2026-90819 | A2 a2a-java a2aproject | 7.3 | Sep 14 | a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting |
| CVE-2026-90790 | A2 a2a-python a2aproject | 6.3 | Sep 14 | a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery |