CVE-2026-116477Medium· 4.3▾ SunlitA security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
a2a-dotnet 1.0.0-preview2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116478Medium· 5.3a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
CVE-2026-116479Medium· 4.3a2aproject a2a-java JSON-RPC Error getMessage information exposure
CVE-2026-116476Medium· 5.4a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition
CVE-2026-113705Medium· 5.3a2aproject a2a-rs error.rs information exposure
CVE-2026-113706Low· 3.5a2aproject a2a-rs inmemory.rs information disclosure
CVE-2026-118128Medium· 6.5a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition