Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-92357 (GCVE-0-2026-92357)

Vulnerability from nvd – Published: 2026-09-16 11:00 – Updated: 2026-09-16 11:00 X_Open Source

Title

a2ui-project a2ui Model Processor model-processor.ts information disclosure

Summary

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

CWE

CWE-200 - Information Disclosure
CWE-284 - Improper Access Controls

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/405444	vdb-entrytechnical-description
https://vuldb.com/vuln/405444/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92357	third-party-advisory
https://vuldb.com/submit/934118	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2299	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2355	issue-trackingpatch
https://github.com/a2ui-project/a2ui/commit/1b3bf…	patch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.8 Affected: 0.9 Affected: 1.0 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Model Processor"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.8"
            },
            {
              "status": "affected",
              "version": "0.9"
            },
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T11:00:17.601Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-405444 | a2ui-project a2ui Model Processor model-processor.ts information disclosure",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/405444"
        },
        {
          "name": "VDB-405444 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/405444/cti"
        },
        {
          "name": "CVE-2026-92357 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92357"
        },
        {
          "name": "Submit #934118 | a2ui-project a2ui v1.0 CWE-200",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934118"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2299"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2355"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/commit/1b3bff234661ce922cbc3771be642b23ec9fd0fa"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-16T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-16T07:24:53.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Model Processor model-processor.ts information disclosure",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92357",
    "datePublished": "2026-09-16T11:00:17.601Z",
    "dateReserved": "2026-09-16T05:19:44.490Z",
    "dateUpdated": "2026-09-16T11:00:17.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92356 (GCVE-0-2026-92356)

Vulnerability from nvd – Published: 2026-09-16 10:15 – Updated: 2026-09-16 17:51

Title

a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption

Summary

A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 17:51 UTC

CWE

CWE-400 - Resource Consumption
CWE-404 - Denial of Service

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/405443	vdb-entrytechnical-description
https://vuldb.com/vuln/405443/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92356	third-party-advisory
https://vuldb.com/submit/934117	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2298	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.9 Affected: 0.9.1 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92356",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:51:21.283915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T17:51:42.059Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Update Components"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.9"
            },
            {
              "status": "affected",
              "version": "0.9.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T10:15:10.856Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-405443 | a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/405443"
        },
        {
          "name": "VDB-405443 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/405443/cti"
        },
        {
          "name": "CVE-2026-92356 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92356"
        },
        {
          "name": "Submit #934117 | a2ui-project a2ui v0.9 CWE-400",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934117"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2298"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-16T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-16T07:24:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92356",
    "datePublished": "2026-09-16T10:15:10.856Z",
    "dateReserved": "2026-09-16T05:19:40.243Z",
    "dateUpdated": "2026-09-16T17:51:42.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92217 (GCVE-0-2026-92217)

Vulnerability from nvd – Published: 2026-09-16 02:00 – Updated: 2026-09-16 02:00

Title

a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

Summary

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

CWE

CWE-915 - Dynamically-Determined Object Attributes
CWE-913 - Dynamically-Managed Code Resources

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/404462	vdb-entrytechnical-description
https://vuldb.com/vuln/404462/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92217	third-party-advisory
https://vuldb.com/submit/934116	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2297	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Message Parsing"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T02:00:16.889Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404462 | a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404462"
        },
        {
          "name": "VDB-404462 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404462/cti"
        },
        {
          "name": "CVE-2026-92217 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92217"
        },
        {
          "name": "Submit #934116 | a2ui-project a2ui 0.10.6 CWE-20",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934116"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2297"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:32.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92217",
    "datePublished": "2026-09-16T02:00:16.889Z",
    "dateReserved": "2026-09-15T18:29:12.619Z",
    "dateUpdated": "2026-09-16T02:00:16.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92216 (GCVE-0-2026-92216)

Vulnerability from nvd – Published: 2026-09-16 01:45 – Updated: 2026-09-16 19:00

Title

a2ui-project a2ui Binder generic-binder.ts openUrl redirect

Summary

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 18:53 UTC

CWE

CWE-601 - Open Redirect

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/404461	vdb-entrytechnical-description
https://vuldb.com/vuln/404461/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92216	third-party-advisory
https://vuldb.com/submit/934110	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2296	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 Affected: 0.10.7 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:53:34.473173Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:00:15.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Binder"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            },
            {
              "status": "affected",
              "version": "0.10.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "Open Redirect",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T01:45:16.460Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404461 | a2ui-project a2ui Binder generic-binder.ts openUrl redirect",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404461"
        },
        {
          "name": "VDB-404461 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404461/cti"
        },
        {
          "name": "CVE-2026-92216 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92216"
        },
        {
          "name": "Submit #934110 | a2ui-project a2ui v1.0 CWE-601",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934110"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2296"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Binder generic-binder.ts openUrl redirect",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92216",
    "datePublished": "2026-09-16T01:45:16.460Z",
    "dateReserved": "2026-09-15T18:29:09.149Z",
    "dateUpdated": "2026-09-16T19:00:15.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92215 (GCVE-0-2026-92215)

Vulnerability from nvd – Published: 2026-09-16 01:30 – Updated: 2026-09-16 19:38 X_Open Source

Title

a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

Summary

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:38 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/404460	vdb-entrytechnical-description
https://vuldb.com/vuln/404460/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92215	third-party-advisory
https://vuldb.com/submit/934109	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2295	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2390	issue-trackingpatch
https://github.com/a2ui-project/a2ui/commit/2bb84…	patch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 Affected: 0.10.7 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:38:12.851731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:38:20.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "FileResolver"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            },
            {
              "status": "affected",
              "version": "0.10.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T01:30:18.718Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404460 | a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404460"
        },
        {
          "name": "VDB-404460 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404460/cti"
        },
        {
          "name": "CVE-2026-92215 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92215"
        },
        {
          "name": "Submit #934109 | a2ui-project a2ui V1.0 CWE-918",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934109"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2295"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2390"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/commit/2bb8423060308bbdea8ba468dabed4fc256d18ea"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:25.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92215",
    "datePublished": "2026-09-16T01:30:18.718Z",
    "dateReserved": "2026-09-15T18:29:05.720Z",
    "dateUpdated": "2026-09-16T19:38:20.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92214 (GCVE-0-2026-92214)

Vulnerability from nvd – Published: 2026-09-16 01:15 – Updated: 2026-09-16 01:15

Title

a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting

Summary

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/404459	vdb-entry
https://vuldb.com/vuln/404459/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92214	third-party-advisory
https://vuldb.com/submit/934108	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2294	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 Affected: 0.10.7 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "a2a-chat-canvas"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            },
            {
              "status": "affected",
              "version": "0.10.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T01:15:13.472Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404459 | a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/404459"
        },
        {
          "name": "VDB-404459 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404459/cti"
        },
        {
          "name": "CVE-2026-92214 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92214"
        },
        {
          "name": "Submit #934108 | a2ui-project a2ui v0.0.1 CWE-79",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934108"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2294"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:22.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92214",
    "datePublished": "2026-09-16T01:15:13.472Z",
    "dateReserved": "2026-09-15T18:29:02.300Z",
    "dateUpdated": "2026-09-16T01:15:13.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92213 (GCVE-0-2026-92213)

Vulnerability from nvd – Published: 2026-09-16 00:00 – Updated: 2026-09-16 19:39 X_Open Source

Title

a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

Summary

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

5.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:39 UTC

CWE

CWE-74 - Injection
CWE-707 - Improper Neutralization

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/404458	vdb-entrytechnical-description
https://vuldb.com/vuln/404458/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92213	third-party-advisory
https://vuldb.com/submit/934101	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2293	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2367	issue-trackingpatch
https://github.com/a2ui-project/a2ui/commit/fb8e8…	patch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:39:22.402454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:39:32.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Angular Renderer"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-707",
              "description": "Improper Neutralization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T00:00:24.104Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404458 | a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404458"
        },
        {
          "name": "VDB-404458 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404458/cti"
        },
        {
          "name": "CVE-2026-92213 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92213"
        },
        {
          "name": "Submit #934101 | a2ui-project a2ui 0.10.6 CWE-20",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934101"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2293"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2367"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/commit/fb8e85aec78d04e81feb9992a57638ca1ec4dc1b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:19.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92213",
    "datePublished": "2026-09-16T00:00:24.104Z",
    "dateReserved": "2026-09-15T18:28:56.437Z",
    "dateUpdated": "2026-09-16T19:39:32.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92114 (GCVE-0-2026-92114)

Vulnerability from nvd – Published: 2026-09-15 21:30 – Updated: 2026-09-16 19:13

Title

a2ui-project a2ui Basic Catalog safe_regex.ts redos

Summary

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:13 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity
CWE-400 - Resource Consumption

Assigner

VulDB mitre root

References

7 references

URL	Tags
https://vuldb.com/vuln/404283	vdb-entry
https://vuldb.com/vuln/404283/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92114	third-party-advisory
https://vuldb.com/submit/934085	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2292	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2366	issue-trackingpatch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92114",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:13:12.763135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:13:23.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Basic Catalog"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T21:30:19.468Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404283 | a2ui-project a2ui Basic Catalog safe_regex.ts redos",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/404283"
        },
        {
          "name": "VDB-404283 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404283/cti"
        },
        {
          "name": "CVE-2026-92114 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92114"
        },
        {
          "name": "Submit #934085 | a2ui-project a2ui 0.10.6 CWE-1333",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934085"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2292"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2366"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T17:41:00.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Basic Catalog safe_regex.ts redos",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92114",
    "datePublished": "2026-09-15T21:30:19.468Z",
    "dateReserved": "2026-09-15T15:35:54.705Z",
    "dateUpdated": "2026-09-16T19:13:23.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92357 (GCVE-0-2026-92357)

Vulnerability from cvelistv5 – Published: 2026-09-16 11:00 – Updated: 2026-09-16 11:00 X_Open Source

Title

a2ui-project a2ui Model Processor model-processor.ts information disclosure

Summary

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

CWE

CWE-200 - Information Disclosure
CWE-284 - Improper Access Controls

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/405444	vdb-entrytechnical-description
https://vuldb.com/vuln/405444/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92357	third-party-advisory
https://vuldb.com/submit/934118	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2299	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2355	issue-trackingpatch
https://github.com/a2ui-project/a2ui/commit/1b3bf…	patch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.8 Affected: 0.9 Affected: 1.0 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Model Processor"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.8"
            },
            {
              "status": "affected",
              "version": "0.9"
            },
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T11:00:17.601Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-405444 | a2ui-project a2ui Model Processor model-processor.ts information disclosure",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/405444"
        },
        {
          "name": "VDB-405444 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/405444/cti"
        },
        {
          "name": "CVE-2026-92357 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92357"
        },
        {
          "name": "Submit #934118 | a2ui-project a2ui v1.0 CWE-200",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934118"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2299"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2355"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/commit/1b3bff234661ce922cbc3771be642b23ec9fd0fa"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-16T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-16T07:24:53.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Model Processor model-processor.ts information disclosure",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92357",
    "datePublished": "2026-09-16T11:00:17.601Z",
    "dateReserved": "2026-09-16T05:19:44.490Z",
    "dateUpdated": "2026-09-16T11:00:17.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92356 (GCVE-0-2026-92356)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:15 – Updated: 2026-09-16 17:51

Title

a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption

Summary

A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 17:51 UTC

CWE

CWE-400 - Resource Consumption
CWE-404 - Denial of Service

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/405443	vdb-entrytechnical-description
https://vuldb.com/vuln/405443/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92356	third-party-advisory
https://vuldb.com/submit/934117	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2298	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.9 Affected: 0.9.1 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92356",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:51:21.283915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T17:51:42.059Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Update Components"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.9"
            },
            {
              "status": "affected",
              "version": "0.9.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T10:15:10.856Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-405443 | a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/405443"
        },
        {
          "name": "VDB-405443 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/405443/cti"
        },
        {
          "name": "CVE-2026-92356 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92356"
        },
        {
          "name": "Submit #934117 | a2ui-project a2ui v0.9 CWE-400",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934117"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2298"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-16T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-16T07:24:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92356",
    "datePublished": "2026-09-16T10:15:10.856Z",
    "dateReserved": "2026-09-16T05:19:40.243Z",
    "dateUpdated": "2026-09-16T17:51:42.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92217 (GCVE-0-2026-92217)

Vulnerability from cvelistv5 – Published: 2026-09-16 02:00 – Updated: 2026-09-16 02:00

Title

a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

Summary

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

CWE

CWE-915 - Dynamically-Determined Object Attributes
CWE-913 - Dynamically-Managed Code Resources

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/404462	vdb-entrytechnical-description
https://vuldb.com/vuln/404462/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92217	third-party-advisory
https://vuldb.com/submit/934116	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2297	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Message Parsing"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T02:00:16.889Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404462 | a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404462"
        },
        {
          "name": "VDB-404462 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404462/cti"
        },
        {
          "name": "CVE-2026-92217 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92217"
        },
        {
          "name": "Submit #934116 | a2ui-project a2ui 0.10.6 CWE-20",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934116"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2297"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:32.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92217",
    "datePublished": "2026-09-16T02:00:16.889Z",
    "dateReserved": "2026-09-15T18:29:12.619Z",
    "dateUpdated": "2026-09-16T02:00:16.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92216 (GCVE-0-2026-92216)

Vulnerability from cvelistv5 – Published: 2026-09-16 01:45 – Updated: 2026-09-16 19:00

Title

a2ui-project a2ui Binder generic-binder.ts openUrl redirect

Summary

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 18:53 UTC

CWE

CWE-601 - Open Redirect

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/404461	vdb-entrytechnical-description
https://vuldb.com/vuln/404461/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92216	third-party-advisory
https://vuldb.com/submit/934110	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2296	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 Affected: 0.10.7 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:53:34.473173Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:00:15.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Binder"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            },
            {
              "status": "affected",
              "version": "0.10.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "Open Redirect",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T01:45:16.460Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404461 | a2ui-project a2ui Binder generic-binder.ts openUrl redirect",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404461"
        },
        {
          "name": "VDB-404461 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404461/cti"
        },
        {
          "name": "CVE-2026-92216 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92216"
        },
        {
          "name": "Submit #934110 | a2ui-project a2ui v1.0 CWE-601",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934110"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2296"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Binder generic-binder.ts openUrl redirect",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92216",
    "datePublished": "2026-09-16T01:45:16.460Z",
    "dateReserved": "2026-09-15T18:29:09.149Z",
    "dateUpdated": "2026-09-16T19:00:15.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92215 (GCVE-0-2026-92215)

Vulnerability from cvelistv5 – Published: 2026-09-16 01:30 – Updated: 2026-09-16 19:38 X_Open Source

Title

a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

Summary

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:38 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/404460	vdb-entrytechnical-description
https://vuldb.com/vuln/404460/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92215	third-party-advisory
https://vuldb.com/submit/934109	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2295	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2390	issue-trackingpatch
https://github.com/a2ui-project/a2ui/commit/2bb84…	patch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 Affected: 0.10.7 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:38:12.851731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:38:20.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "FileResolver"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            },
            {
              "status": "affected",
              "version": "0.10.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T01:30:18.718Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404460 | a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404460"
        },
        {
          "name": "VDB-404460 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404460/cti"
        },
        {
          "name": "CVE-2026-92215 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92215"
        },
        {
          "name": "Submit #934109 | a2ui-project a2ui V1.0 CWE-918",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934109"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2295"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2390"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/commit/2bb8423060308bbdea8ba468dabed4fc256d18ea"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:25.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92215",
    "datePublished": "2026-09-16T01:30:18.718Z",
    "dateReserved": "2026-09-15T18:29:05.720Z",
    "dateUpdated": "2026-09-16T19:38:20.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92214 (GCVE-0-2026-92214)

Vulnerability from cvelistv5 – Published: 2026-09-16 01:15 – Updated: 2026-09-16 01:15

Title

a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting

Summary

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/vuln/404459	vdb-entry
https://vuldb.com/vuln/404459/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92214	third-party-advisory
https://vuldb.com/submit/934108	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2294	issue-tracking
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 Affected: 0.10.7 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "a2a-chat-canvas"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            },
            {
              "status": "affected",
              "version": "0.10.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T01:15:13.472Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404459 | a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/404459"
        },
        {
          "name": "VDB-404459 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404459/cti"
        },
        {
          "name": "CVE-2026-92214 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92214"
        },
        {
          "name": "Submit #934108 | a2ui-project a2ui v0.0.1 CWE-79",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934108"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2294"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:22.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92214",
    "datePublished": "2026-09-16T01:15:13.472Z",
    "dateReserved": "2026-09-15T18:29:02.300Z",
    "dateUpdated": "2026-09-16T01:15:13.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92213 (GCVE-0-2026-92213)

Vulnerability from cvelistv5 – Published: 2026-09-16 00:00 – Updated: 2026-09-16 19:39 X_Open Source

Title

a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

Summary

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

5.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:39 UTC

CWE

CWE-74 - Injection
CWE-707 - Improper Neutralization

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/404458	vdb-entrytechnical-description
https://vuldb.com/vuln/404458/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92213	third-party-advisory
https://vuldb.com/submit/934101	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2293	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2367	issue-trackingpatch
https://github.com/a2ui-project/a2ui/commit/fb8e8…	patch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:39:22.402454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:39:32.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Angular Renderer"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-707",
              "description": "Improper Neutralization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T00:00:24.104Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404458 | a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/404458"
        },
        {
          "name": "VDB-404458 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404458/cti"
        },
        {
          "name": "CVE-2026-92213 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92213"
        },
        {
          "name": "Submit #934101 | a2ui-project a2ui 0.10.6 CWE-20",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934101"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2293"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2367"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/commit/fb8e85aec78d04e81feb9992a57638ca1ec4dc1b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T20:34:19.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92213",
    "datePublished": "2026-09-16T00:00:24.104Z",
    "dateReserved": "2026-09-15T18:28:56.437Z",
    "dateUpdated": "2026-09-16T19:39:32.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92114 (GCVE-0-2026-92114)

Vulnerability from cvelistv5 – Published: 2026-09-15 21:30 – Updated: 2026-09-16 19:13

Title

a2ui-project a2ui Basic Catalog safe_regex.ts redos

Summary

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:13 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity
CWE-400 - Resource Consumption

Assigner

VulDB mitre root

References

7 references

URL	Tags
https://vuldb.com/vuln/404283	vdb-entry
https://vuldb.com/vuln/404283/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92114	third-party-advisory
https://vuldb.com/submit/934085	third-party-advisory
https://github.com/a2ui-project/a2ui/issues/2292	issue-tracking
https://github.com/a2ui-project/a2ui/pull/2366	issue-trackingpatch
https://github.com/a2ui-project/a2ui/	product

Impacted products

1 product

Vendor	Product	Version
a2ui-project	a2ui	Affected: 0.10.0 Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui::::::::

Credits

colorfullbz (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92114",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:13:12.763135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:13:23.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Basic Catalog"
          ],
          "product": "a2ui",
          "vendor": "a2ui-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            },
            {
              "status": "affected",
              "version": "0.10.5"
            },
            {
              "status": "affected",
              "version": "0.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T21:30:19.468Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-404283 | a2ui-project a2ui Basic Catalog safe_regex.ts redos",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/404283"
        },
        {
          "name": "VDB-404283 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/404283/cti"
        },
        {
          "name": "CVE-2026-92114 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-92114"
        },
        {
          "name": "Submit #934085 | a2ui-project a2ui 0.10.6 CWE-1333",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/934085"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/2292"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/2366"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2ui-project/a2ui/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-15T17:41:00.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui-project a2ui Basic Catalog safe_regex.ts redos",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-92114",
    "datePublished": "2026-09-15T21:30:19.468Z",
    "dateReserved": "2026-09-15T15:35:54.705Z",
    "dateUpdated": "2026-09-16T19:13:23.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

16 vulnerabilities by a2ui-project

CVE-2026-92357 (GCVE-0-2026-92357)

CVE-2026-92356 (GCVE-0-2026-92356)

CVE-2026-92217 (GCVE-0-2026-92217)

CVE-2026-92216 (GCVE-0-2026-92216)

CVE-2026-92215 (GCVE-0-2026-92215)

CVE-2026-92214 (GCVE-0-2026-92214)

CVE-2026-92213 (GCVE-0-2026-92213)

CVE-2026-92114 (GCVE-0-2026-92114)

CVE-2026-92357 (GCVE-0-2026-92357)

CVE-2026-92356 (GCVE-0-2026-92356)

CVE-2026-92217 (GCVE-0-2026-92217)

CVE-2026-92216 (GCVE-0-2026-92216)

CVE-2026-92215 (GCVE-0-2026-92215)

CVE-2026-92214 (GCVE-0-2026-92214)

CVE-2026-92213 (GCVE-0-2026-92213)

CVE-2026-92114 (GCVE-0-2026-92114)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

16 vulnerabilities by a2ui-project

CVE-2026-92357 (GCVE-0-2026-92357)

CVE-2026-92356 (GCVE-0-2026-92356)

CVE-2026-92217 (GCVE-0-2026-92217)

CVE-2026-92216 (GCVE-0-2026-92216)

CVE-2026-92215 (GCVE-0-2026-92215)

CVE-2026-92214 (GCVE-0-2026-92214)

CVE-2026-92213 (GCVE-0-2026-92213)

CVE-2026-92114 (GCVE-0-2026-92114)

CVE-2026-92357 (GCVE-0-2026-92357)

CVE-2026-92356 (GCVE-0-2026-92356)

CVE-2026-92217 (GCVE-0-2026-92217)

CVE-2026-92216 (GCVE-0-2026-92216)

CVE-2026-92215 (GCVE-0-2026-92215)

CVE-2026-92214 (GCVE-0-2026-92214)

CVE-2026-92213 (GCVE-0-2026-92213)

CVE-2026-92114 (GCVE-0-2026-92114)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.