CVE-2026-118275 is a resource consumption vulnerability in the a2ui-project a2ui component, specifically affecting versions 0.10.0 through 0.10.6. The flaw exists in the DataContext.resolveSignal function within the Resolver component. This vulnerability can be exploited remotely without authentication and has publicly available exploit code. A patch identified by commit c76e17272e52c12c6dcf68905b1df978c39e9aa5 addresses the issue. The CVSS 4.0 score is 6.9, indicating a medium severity level.
CVE-2026-118274 is a medium severity vulnerability in the a2ui-project a2ui component up to version 0.10.6. It affects an unknown functionality within the Binder component's generic-binder.ts file, leading to resource consumption. The vulnerability can be exploited remotely without user interaction and requires low privileges. A patch identified by commit c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e is available to fix the issue.
CVE-2026-118273 is a medium severity vulnerability in a2ui-project's a2ui component up to version 0.10.6. The flaw exists in the DataModel.set function of the file renderers/web_core/src/v0_9/state/data-model.ts and can be exploited remotely to cause resource consumption. Exploit code has been published. A patch identified by commit 82789191ce551f4d7a095d273773fb24bd764c9d is available to remediate this issue.
CVE-2026-118272 is a medium severity vulnerability in a2ui-project's a2ui component up to version 0.10.6. It involves the DataContext.dispatchExpressionError function in the Error Handler component, where manipulation can cause information exposure through error messages. The vulnerability can be exploited remotely. A patch identified by commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 is available to address this issue.
CVE-2026-118271 is a medium severity vulnerability in a2ui-project a2ui versions 0.10.0 through 0.10.6. It involves resource consumption caused by manipulation of an unknown function in the data-context Resolver component. The vulnerability can be exploited remotely without user interaction or privileges. Public exploit code has been disclosed. A patch identified by commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 is available to remediate the issue.
A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.
A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-92217 is a medium severity vulnerability in the a2ui-project a2ui component up to version 0.10.6. It affects the processMessages function in the message-processor.ts file, causing dynamically-determined object attributes. The vulnerability can be exploited remotely and was reported to the project, which has not yet responded or issued a fix.
CVE-2026-92216 is an open redirect vulnerability in the a2ui-project's a2ui component, specifically affecting the openUrl function in the Binder component. This vulnerability exists in versions 0.10.0 through 0.10.7 and allows remote attackers to manipulate URLs to redirect users to unintended destinations. The issue was reported to the project early, but no response or fix has been issued yet. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-92215 is a server-side request forgery (SSRF) vulnerability in the a2ui-project a2ui software up to version 0.10.7. The flaw exists in the httpx.get function within the FileResolver component, allowing remote attackers to manipulate requests. This vulnerability has a medium severity rating with a CVSS score of 6.9. A patch identified by commit 2bb8423060308bbdea8ba468dabed4fc256d18ea is recommended to remediate the issue.
A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.
CVE-2026-92213 is a medium severity injection vulnerability in the a2ui-project a2ui component versions 0.10.0 through 0.10.6. It affects the Angular Renderer function z.any in the file renderers/web_core/src/v0_9/schema/server-to-client.ts. The vulnerability allows remote attackers to perform injection by manipulating the argument primaryColor. A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is available to address this issue.
CVE-2026-92114 is a medium severity vulnerability in the a2ui-project a2ui software up to version 0.10.6. It involves inefficient regular expression complexity in an unspecified function within the Basic Catalog component. This flaw can be exploited remotely and may lead to performance degradation or denial of service conditions due to excessive resource consumption during regex processing.