com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-117507 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-117507 Source advisory: MEND:CVE-2026-117507...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-117506 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-117506 Source advisory: MEND:CVE-2026-117506...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-117505 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-117505 Source advisory: MEND:CVE-2026-117505...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-3260)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3260 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

A2A Java SDK Has A Fail-open Default Task Authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. - Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common"...

A2A Java SDK Has Server-Side Request Forgery (SSRF) In Push-notification Delivery

- Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common" push-notification delivery - Affected versions: "= 1.2.0.Final" and "1.2.1.Final-SNAPSHOT" on "main" prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request...

GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111761 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111761 Source advisory: OSV:GHSA-Q78C-5JJQ-57G8...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111761 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111761 Source advisory: GHSA-Q78C-5JJQ-57G8...

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111764 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111764 Source advisory: GHSA-QW47-MCM5-934W...

A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111764 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111764 Source advisory: OSV:GHSA-QW47-MCM5-934W...

CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111764 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111764 Source advisory: MEND:CVE-2026-111764...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111761 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111761 Source advisory: MEND:CVE-2026-111761...

CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

EUVD-2026-105043

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...