[ Vendor · 9 CVEs ]
a2aproject
CVEs affecting a2aproject published in the last 30 days, plus any a2aproject CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-113707 | 21 Oct 2026 | CVSS 5.4 | a2aproject a2a-rsA security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file… | |
| CVE-2026-113706 | 21 Oct 2026 | CVSS 3.5 | a2aproject a2a-rsA vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs… | |
| CVE-2026-113705 | 20 Oct 2026 | CVSS 5.3 | a2aproject a2a-rsA vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs… | |
| CVE-2026-113704 | 20 Oct 2026 | CVSS 7.3 | a2aproject a2a-rsA vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file… | |
| CVE-2026-111763 | 20 Oct 2026 | CVSS 5.7 | A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirectA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the… | Fix |
| CVE-2026-111764 | 20 Oct 2026 | CVSS 7.5 | A2A Java SDK has a fail-open default task authorizationA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs… | Fix |
| CVE-2026-111765 | 20 Oct 2026 | CVSS 7.5 | A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the… | Fix |
| CVE-2026-111762 | 20 Oct 2026 | CVSS 5.7 | A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failureA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in… | Fix |
| CVE-2026-111761 | 20 Oct 2026 | CVSS 5.8 | A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification deliveryA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends… | Fix |