https://vulnogram.org/ Most recent CVEs assigned by Google LLC (google). https://vulnogram.org/seaview/icons/google.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-105772 https://vulnogram.org/CVE-2026-105772 Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes… Critical Network Exploitable Tue, 20 Oct 2026 17:50:13 GMT https://vulnogram.org/CVE-2026-103091 https://vulnogram.org/CVE-2026-103091 Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server… Critical Network Exploitable Mon, 19 Oct 2026 02:24:35 GMT https://vulnogram.org/CVE-2026-102503 https://vulnogram.org/CVE-2026-102503 Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 all… Critical Network Exploitable Mon, 19 Oct 2026 02:20:35 GMT https://vulnogram.org/CVE-2026-102554 https://vulnogram.org/CVE-2026-102554 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, Com… High Network Exploitable Fri, 09 Oct 2026 15:07:16 GMT https://vulnogram.org/CVE-2026-95702 https://vulnogram.org/CVE-2026-95702 Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile… High Fri, 09 Oct 2026 14:44:35 GMT https://vulnogram.org/CVE-2026-102252 https://vulnogram.org/CVE-2026-102252 A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VM… Medium Tue, 29 Sep 2026 19:41:42 GMT https://vulnogram.org/CVE-2026-102242 https://vulnogram.org/CVE-2026-102242 Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary r… High Tue, 29 Sep 2026 17:47:16 GMT https://vulnogram.org/CVE-2026-87723 https://vulnogram.org/CVE-2026-87723 In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to… Medium Mon, 28 Sep 2026 04:02:14 GMT https://vulnogram.org/CVE-2026-96812 https://vulnogram.org/CVE-2026-96812 Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code… High Fri, 25 Sep 2026 14:47:47 GMT https://vulnogram.org/CVE-2026-87722 https://vulnogram.org/CVE-2026-87722 Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= an… High Network Exploitable Thu, 24 Sep 2026 22:03:48 GMT https://vulnogram.org/CVE-2026-87721 https://vulnogram.org/CVE-2026-87721 Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote a… High Network Exploitable Thu, 24 Sep 2026 22:02:07 GMT https://vulnogram.org/CVE-2026-87720 https://vulnogram.org/CVE-2026-87720 Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 all… High Thu, 24 Sep 2026 21:59:06 GMT https://vulnogram.org/CVE-2026-19202 https://vulnogram.org/CVE-2026-19202 A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within… Critical Network Exploitable Tue, 22 Sep 2026 21:48:26 GMT https://vulnogram.org/CVE-2026-89418 https://vulnogram.org/CVE-2026-89418 google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API,… High Network Exploitable Thu, 17 Sep 2026 13:27:30 GMT https://vulnogram.org/CVE-2026-83530 https://vulnogram.org/CVE-2026-83530 A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enf… Medium Network Exploitable Wed, 09 Sep 2026 14:56:22 GMT https://vulnogram.org/CVE-2026-19201 https://vulnogram.org/CVE-2026-19201 An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for… Medium Network Exploitable Tue, 08 Sep 2026 23:48:38 GMT https://vulnogram.org/CVE-2026-75062 https://vulnogram.org/CVE-2026-75062 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the c… Critical Network Exploitable Wed, 26 Aug 2026 14:50:50 GMT https://vulnogram.org/CVE-2026-10032 https://vulnogram.org/CVE-2026-10032 The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When th… Medium Tue, 04 Aug 2026 15:36:45 GMT https://vulnogram.org/CVE-2026-14541 https://vulnogram.org/CVE-2026-14541 An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience o… High Network Exploitable Fri, 31 Jul 2026 01:48:39 GMT https://vulnogram.org/CVE-2026-14540 https://vulnogram.org/CVE-2026-14540 A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the… High Network Exploitable Fri, 31 Jul 2026 01:46:54 GMT https://vulnogram.org/CVE-2026-14539 https://vulnogram.org/CVE-2026-14539 An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads inco… Medium Network Exploitable Fri, 31 Jul 2026 01:45:35 GMT https://vulnogram.org/CVE-2026-14538 https://vulnogram.org/CVE-2026-14538 An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The tool… Medium Fri, 31 Jul 2026 01:42:29 GMT https://vulnogram.org/CVE-2026-14537 https://vulnogram.org/CVE-2026-14537 Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests th… High Network Exploitable Fri, 31 Jul 2026 01:38:18 GMT https://vulnogram.org/CVE-2026-18236 https://vulnogram.org/CVE-2026-18236 A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation re… Critical Network Exploitable Wed, 29 Jul 2026 17:37:01 GMT https://vulnogram.org/CVE-2026-16481 https://vulnogram.org/CVE-2026-16481 A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET reque… Medium Mon, 27 Jul 2026 19:13:29 GMT https://vulnogram.org/CVE-2026-15432 https://vulnogram.org/CVE-2026-15432 When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes… High Network Exploitable Tue, 21 Jul 2026 16:42:12 GMT https://vulnogram.org/CVE-2026-15829 https://vulnogram.org/CVE-2026-15829 A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox. The tool accepts client-controlled parameters (data_col, timestamp_col, and… High Tue, 21 Jul 2026 16:39:54 GMT https://vulnogram.org/CVE-2026-11720 https://vulnogram.org/CVE-2026-11720 A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting str… Critical Network Exploitable Mon, 29 Jun 2026 17:51:30 GMT https://vulnogram.org/CVE-2026-12681 https://vulnogram.org/CVE-2026-12681 Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attack… High Network Exploitable Wed, 24 Jun 2026 00:49:13 GMT https://vulnogram.org/CVE-2026-11719 https://vulnogram.org/CVE-2026-11719 An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by… High Thu, 18 Jun 2026 11:55:03 GMT https://vulnogram.org/CVE-2026-11718 https://vulnogram.org/CVE-2026-11718 An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the r… Critical Network Exploitable Thu, 18 Jun 2026 11:52:42 GMT https://vulnogram.org/CVE-2026-11717 https://vulnogram.org/CVE-2026-11717 An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), the toolbox decodes… Critical Network Exploitable Thu, 18 Jun 2026 11:50:23 GMT https://vulnogram.org/CVE-2026-11624 https://vulnogram.org/CVE-2026-11624 The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0,… Critical Network Exploitable Sat, 13 Jun 2026 08:38:42 GMT https://vulnogram.org/CVE-2026-9739 https://vulnogram.org/CVE-2026-9739 Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *`… Critical Network Exploitable Wed, 27 May 2026 21:38:55 GMT https://vulnogram.org/CVE-2026-8369 https://vulnogram.org/CVE-2026-8369 Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security che… Medium Wed, 13 May 2026 13:36:09 GMT https://vulnogram.org/CVE-2026-2725 https://vulnogram.org/CVE-2026-2725 Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches v… Medium Wed, 13 May 2026 05:32:49 GMT https://vulnogram.org/CVE-2026-6409 https://vulnogram.org/CVE-2026-6409 A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, i… High Network Exploitable Thu, 16 Apr 2026 14:30:51 GMT https://vulnogram.org/CVE-2026-4092 https://vulnogram.org/CVE-2026-4092 Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences. High Network Exploitable Fri, 13 Mar 2026 15:44:55 GMT https://vulnogram.org/CVE-2026-3223 https://vulnogram.org/CVE-2026-3223 Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer. High Fri, 27 Feb 2026 13:12:38 GMT https://vulnogram.org/CVE-2026-1669 https://vulnogram.org/CVE-2026-1669 Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file ut… High Network Exploitable Wed, 11 Feb 2026 22:10:10 GMT https://vulnogram.org/CVE-2025-12474 https://vulnogram.org/CVE-2025-12474 A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization caus… Low Network Exploitable Wed, 11 Feb 2026 15:27:24 GMT https://vulnogram.org/CVE-2026-1837 https://vulnogram.org/CVE-2026-1837 A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformati… High Network Exploitable Wed, 11 Feb 2026 15:19:55 GMT https://vulnogram.org/CVE-2026-0994 https://vulnogram.org/CVE-2026-0994 A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting insid… High Network Exploitable Fri, 23 Jan 2026 14:55:16 GMT https://vulnogram.org/CVE-2026-1260 https://vulnogram.org/CVE-2026-1260 Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure. High Thu, 22 Jan 2026 17:06:17 GMT https://vulnogram.org/CVE-2026-0897 https://vulnogram.org/CVE-2026-0897 Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the P… High Network Exploitable Thu, 15 Jan 2026 14:09:53 GMT https://vulnogram.org/CVE-2025-13437 https://vulnogram.org/CVE-2025-13437 When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (… Medium Thu, 20 Nov 2025 16:25:16 GMT https://vulnogram.org/CVE-2025-13425 https://vulnogram.org/CVE-2025-13425 A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of servi… Low Thu, 20 Nov 2025 15:30:31 GMT https://vulnogram.org/CVE-2025-12060 https://vulnogram.org/CVE-2025-12060 The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can c… High Thu, 30 Oct 2025 17:10:43 GMT https://vulnogram.org/CVE-2025-12058 https://vulnogram.org/CVE-2025-12058 The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF). This vulnerability stems from the way the StringLoo… Medium Wed, 29 Oct 2025 08:48:29 GMT https://vulnogram.org/CVE-2025-12080 https://vulnogram.org/CVE-2025-12080 On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented. Du… Medium Mon, 27 Oct 2025 08:45:52 GMT