Aa2aproject

Products

Exploited and recent CVEs

• CVE-2026-118128 Medium 6.5 a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition 0.4%
• CVE-2026-117507 Medium 5.4 a2aproject a2a-java TaskManager.saveTaskEvent race condition 0.3%
• CVE-2026-117506 Medium 4.3 a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption 0.3%
• CVE-2026-117505 Medium 4.3 a2aproject a2a-java ChildQueue queue.offer resource consumption 0.3%
• CVE-2026-117504 Medium 5.3 a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service 0.6%
• CVE-2026-117503 Medium 5.3 a2aproject a2a-go REST SSE handler rest.go resource consumption 0.7%
• CVE-2026-116479 Medium 4.3 a2aproject a2a-java JSON-RPC Error getMessage information exposure 0.3%
• CVE-2026-116478 Medium 5.3 a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure 0.4%
• CVE-2026-116477 Medium 4.3 a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure 0.3%
• CVE-2026-116476 Medium 5.4 a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition 0.2%
• CVE-2026-113707 Medium 5.4 a2aproject a2a-rs inmemory.rs update race condition 0.3%
• CVE-2026-113706 Low 3.5 a2aproject a2a-rs inmemory.rs information disclosure 0.2%
• CVE-2026-113705 Medium 5.3 a2aproject a2a-rs error.rs information exposure 0.3%
• CVE-2026-113704 High 7.3 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery 0.5%
• CVE-2026-111765 High 7.5 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix 0.8%
• CVE-2026-111764 High 7.5 A2A Java SDK has a fail-open default task authorization 0.6%
• CVE-2026-111763 Medium 5.7 A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect 0.1%
• CVE-2026-111762 Medium 5.7 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure 0.2%
• CVE-2026-111761 Medium 5.8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery 0.6%
• CVE-2026-90820 Medium 4.3 a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization 0.4%
• CVE-2026-90819 High 7.3 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting 0.7%
• CVE-2026-90790 Medium 6.3 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery 0.4%