CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111762

The A2A Java SDK (Agent2Agent Protocol) is vulnerable in versions prior to 1.3.0.Final due to improper handling of failed protobuf deserialization in the RestHandler.parseRequestBody method. When JsonFormat.parser().merge() throws an InvalidProtocolBufferException, the application logs the entire...

CVE-2026-111761

The A2A Java SDK (prior to version 1.3.0.Final ) is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of destination validation, scheme restrictions, or redirect bounds in the BasePushNotificationSender component. An unauthenticated caller can register a destination via SendMessage o...

CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

CVE-2026-107417

Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through...

CVE-2026-107417

The Push Notification for Post and BuddyPress WordPress plugin (versions

CVE-2026-107417 WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through...

EUVD-2026-101023

Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through...

WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Push Notification for Post and BuddyPress versions = 3.23...

CVE-2026-87761

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...

CVE-2026-87762

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

CVE-2026-87761 Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...

CVE-2026-87762

The Adwised Web Push Notification WordPress plugin (versions up to and including 2.5.7 ) is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin lacks authorization checks on several state-changing operations. Furthermore, a secret comparison mechanism can be bypassed on ...

EUVD-2026-96770

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...

EUVD-2026-96771

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

CVE-2026-87761

The Adwised Web Push Notification WordPress plugin, in versions through 2.5.7 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a lack of capability or nonce checks when allowing authenticated users to overwrite site-wide configurations, combined with a failure to es...

CVE-2026-87762 Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

CVE-2026-87762: Improper Neutralization of Input During Web Page Generation

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

PT-2026-110044

Name of the Vulnerable Software and Affected Versions Adwised Web Push Notification versions prior to 2.5.8 Description An authenticated user, including those with subscriber-level privileges, can overwrite site-wide configuration settings because the plugin fails to perform capability or nonce...

CVE-2026-87761: Improper Neutralization of Input During Web Page Generation

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...