Google Cloud - vulnerabilities (CVEs)

61 CVEs in 43 products, 5 in the last 30 days, newest from 2026-10-27.

Products

• Looker - 10 CVEs
• Application Integration - 6 CVEs
• Looker Studio - 3 CVEs
• Agent Development Kit Adk - 2 CVEs
• Apigee-x - 2 CVEs
• Bigquery - 2 CVEs
• Dataform - 2 CVEs
• Dialogflow Cx - 2 CVEs
• Gemini Cli - 2 CVEs
• Google Secops Chronicle Soar - 2 CVEs
• Agent Development Kit Adk For Python - 1 CVEs
• Alloydb For Postgresql - 1 CVEs
• Apigee - 1 CVEs
• Apigee Hybrid Javacallout Policy - 1 CVEs
• Bigquery Data Transfer Service - 1 CVEs
• Classic Application Load Balancer - 1 CVEs
• Cloud Build - 1 CVEs
• Cloud Console Uis - 1 CVEs
• Cloud Data Fusion - 1 CVEs
• Cloud Run Mcp - 1 CVEs
• Cloud Shell - 1 CVEs
• Colab Enterprise - 1 CVEs
• Compute Engine - 1 CVEs
• Dialogflow Cx Messenger - 1 CVEs
• Firebase Studio - 1 CVEs
• Gemini Enterprise Agent Platform App Builder - 1 CVEs
• Gemini Enterprise Agent Platform Sdk For Python - 1 CVEs
• Gemini Enterprise Formerly Agentspace - 1 CVEs
• Google Cloud Build - 1 CVEs
• Google Cloud Secops Soar - 1 CVEs
• Google Secops Soar - 1 CVEs
• Integration Connectors - 1 CVEs
• Internal Integration Platform Apis - 1 CVEs
• Mcp Toolbox For Databases Googleapismcp-toolbox - 1 CVEs
• Migrate To Containers - 1 CVEs
• Run-gemini-cli Github Action - 1 CVEs
• Vertex Ai Experiments - 1 CVEs
• Vertex Ai Open Models For Maas - 1 CVEs
• Vertex Ai Partner Models For Maas - 1 CVEs
• Vertex Ai Sdk For Python - 1 CVEs
• Vertex Ai Search For Commerce - 1 CVEs
• Vertex Ai Self-deployed Models - 1 CVEs
• Vertex Ai Workbench - 1 CVEs

Newest CVEs of Google Cloud

• CVE-2026-85299 - CVSS 8.3 (high), 2026-10-27: A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on…
• CVE-2026-85297 - CVSS 7.7 (high), 2026-10-26: Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code,…
• CVE-2026-93328 - CVSS 9.3 (critical), 2026-10-26: Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through…
• CVE-2026-85267 - CVSS 8.7 (high), 2026-10-20: A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an…
• CVE-2026-85298 - CVSS 7.3 (high), 2026-10-14: An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior…
• CVE-2026-81375 - CVSS 8.3 (high), 2026-09-28: A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform…
• CVE-2026-81867 - CVSS 9.4 (critical), 2026-09-28: A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud…
• CVE-2026-19759 - CVSS 9.4 (critical), 2026-09-28: An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud…
• CVE-2026-19407 - CVSS 7.7 (high), 2026-09-15: Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution…
• CVE-2026-19486 - CVSS 8.7 (high), 2026-09-11: A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud…
• CVE-2026-13745 - CVSS 7.7 (high), 2026-09-10: A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI…
• CVE-2026-79696 - CVSS 10 (critical), 2026-09-09: A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and…
• CVE-2026-4644 - CVSS 8.5 (high), 2026-09-04: A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an…
• CVE-2026-79707 - CVSS 8.7 (high), 2026-09-04: A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an…
• CVE-2026-19410 - CVSS 9.4 (critical), 2026-08-31: An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote…
• CVE-2026-19485 - CVSS 9.3 (critical), 2026-08-26: A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google…
• CVE-2026-12717 - CVSS 9.4 (critical), 2026-08-26: An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on…
• CVE-2026-12710 - CVSS 9.3 (critical), 2026-08-22: A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an…
• CVE-2026-15623 - CVSS 9.4 (critical), 2026-08-17: A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud…
• CVE-2026-15587 - CVSS 9.4 (critical), 2026-08-05: Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate…
• CVE-2026-15810 - CVSS 8.7 (high), 2026-07-24: A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and…
• CVE-2026-12715 - CVSS 8.5 (high), 2026-07-17: Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users'…
• CVE-2026-14934 - CVSS 9.4 (critical), 2026-07-13: A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions…
• CVE-2026-12879 - CVSS 5.9 (medium), 2026-07-09: An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an…
• CVE-2026-12537 - CVSS 10 (critical), 2026-06-24: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action…
• CVE-2026-8934 - CVSS 6.9 (medium), 2026-06-22: A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated…
• CVE-2026-4764 - CVSS 9.4 (critical), 2026-06-11: A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with…
• CVE-2026-2264 - CVSS 9.2 (critical), 2026-05-26: A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate…
• CVE-2026-2031 - CVSS 10 (critical), 2026-05-15: An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote,…
• CVE-2026-7428 - CVSS 9.2 (critical), 2026-05-12: Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default…