Skip to content
Google Cloud vulnerabilities
Newest
-
google cloud application integration
Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
CVE-2026-93327
9.4 Critical
-
google cloud identity platform and firebase authentication
Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
CVE-2026-85268
8.7 High
-
google agent development kit (adk) for python
Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python
CVE-2026-115522
5.3 Medium
-
google compute engine
Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
CVE-2026-85299
8.3 High
-
google cloud cloud run mcp
Bucket Squatting in Cloud Run MCP leads to Service Account Takeover
CVE-2026-85297
7.7 High
-
google mcp toolbox for databases (googleapis/mcp-toolbox)
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
CVE-2026-93328
Public exploit
9.3 Critical
-
google cloud cloud shell
Cross-Site WebSocket Hijacking in Google Cloud Shell
CVE-2026-85267
8.7 High
-
google cloud application integration
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
CVE-2026-85298
7.3 High
-
google cloud application integration
Confused Deputy in Application Integration allows Internal File Read
CVE-2026-81375
8.3 High
-
google cloud application integration
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
CVE-2026-81867
9.4 Critical
-
google cloud application integration
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
CVE-2026-19759
9.4 Critical
-
google cloud gemini enterprise agent platform sdk for python
GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
CVE-2026-19407
7.7 High
-
google cloud gemini enterprise agent platform app builder
SSRF in Gemini Enterprise Agent Platform App Builder
CVE-2026-19486
8.7 High
-
google cloud gemini cli
Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME
CVE-2026-13745
7.7 High
-
google cloud agent development kit (adk) for python
Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
CVE-2026-79696
10.0 Critical
-
google cloud integration connectors
Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover
CVE-2026-4644
8.5 High
-
google cloud agent development kit (adk)
Arbitrary File Read in Google Agent Development Kit (ADK)
CVE-2026-79707
8.7 High
-
google cloud build
Google Cloud Build Comment Control Bypass via Webhook Suppression
CVE-2026-19410
9.4 Critical
-
google cloud vertex ai search for commerce
Bucket Squatting in Vertex AI Search for Commerce
CVE-2026-19485
9.3 Critical
-
google cloud bigquery data transfer service
Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
CVE-2026-12717
9.4 Critical
-
google cloud application integration
Missing Authorization in Application Integration QueryEngineTask
CVE-2026-12710
9.3 Critical
-
google cloud secops (chronicle soar)
Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
CVE-2026-15623
9.4 Critical
-
google cloud secops (chronicle soar)
Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header
CVE-2026-15587
9.4 Critical
-
google cloud looker
Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
CVE-2026-15810
8.7 High
-
google cloud firebase studio
Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft
CVE-2026-12715
8.5 High
-
google cloud bigquery, colab enterprise, dataform +2 more
Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
CVE-2026-14934
9.4 Critical
-
google apigee
Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy
CVE-2026-12879
5.9 Medium
-
google cloud cloud console uis
Cross-Project Information Leakage in Google App Engine UI
CVE-2026-8934
6.9 Medium
-
google cloud dialogflow cx
Privilege Escalation in Dialogflow CX via Playbook Import
CVE-2026-4764
9.4 Critical
-
google cloud apigee-x
Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
CVE-2026-2264
9.2 Critical
-
google cloud internal integration platform apis
Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.
CVE-2026-2031
10.0 Critical
-
google cloud alloydb for postgresql
Insecure default administrative credentials in AlloyDB for PostgreSQL
CVE-2026-7428
9.2 Critical
-
google gemini-cli, run-gemini-cli, google cloud gemini cli +1 more +3 more
Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
CVE-2026-12537
Fix available
10.0 Critical
-
google cloud bigquery
Sensitive Data Disclosure in BigQuery via Materialized View Error Messages
CVE-2026-3259
7.1 High
-
google cloud agent development kit (adk)
Remote Code Execution in Google Agent Development Kit (ADK)
CVE-2026-4810
Fix available
9.3 Critical
-
google cloud build
Google Cloud Build Comment Control Bypass
CVE-2026-3136
8.6 High
-
google cloud vertex ai workbench
Sensitive Data Exposure in Google Cloud Vertex AI Workbench
CVE-2026-2244
8.4 High
-
google cloud vertex ai experiments
Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.
CVE-2026-2473
Fix available
7.7 High
-
google cloud vertex ai sdk for python, red hat openshift ai 2.25 +1 more
Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization
CVE-2026-2472
Public exploitFix available
8.6 High
-
google cloud gemini enterprise (formerly agentspace)
Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
CVE-2026-1727
9.1 Critical
-
google cloud dialogflow cx messenger
Authentication Bypass in Dialogflow CX Messenger
CVE-2025-13427
6.9 Medium
-
google cloud dialogflow cx
Privilege Escalation in Dialogflow CX via Webhook Admin Role
CVE-2025-12952
8.7 High
-
google cloud cloud data fusion
Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload
CVE-2025-9571
8.7 High
-
google cloud secops soar, google security operations soar +1 more
RCE in SecOps SOAR server via user-provided Python packages
CVE-2025-13428
8.6 High
-
google cloud apigee-x
Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.
CVE-2025-13292
7.6 High
-
google cloud apigee hybrid javacallout policy
Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution
CVE-2025-13426
8.7 High
-
google cloud looker
Remote Code Execution in Looker via Teradata JDBC Driver
CVE-2025-12742
7.5 High
-
google cloud looker
Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution
CVE-2025-12741
7.7 High
-
google cloud looker
Remote Command Execution in Looker via IBM DB2 JDBC drive
CVE-2025-12740
7.7 High
-
google cloud looker
Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise
CVE-2025-12739
7.3 High
- Show olderLoading…