https://vulnogram.org/ Most recent CVEs assigned by Google Cloud (googlecloud). https://vulnogram.org/seaview/icons/googlecloud.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-85267 https://vulnogram.org/CVE-2026-85267 A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin We… High Network Exploitable Tue, 20 Oct 2026 09:16:56 GMT https://vulnogram.org/CVE-2026-85298 https://vulnogram.org/CVE-2026-85298 An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service… High Wed, 14 Oct 2026 11:14:00 GMT https://vulnogram.org/CVE-2026-81375 https://vulnogram.org/CVE-2026-81375 A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a cra… High Cloud Hosted Mon, 28 Sep 2026 10:58:46 GMT https://vulnogram.org/CVE-2026-81867 https://vulnogram.org/CVE-2026-81867 A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the… Critical Mon, 28 Sep 2026 10:49:16 GMT https://vulnogram.org/CVE-2026-19759 https://vulnogram.org/CVE-2026-19759 An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside… Critical Mon, 28 Sep 2026 10:34:51 GMT https://vulnogram.org/CVE-2026-19407 https://vulnogram.org/CVE-2026-19407 Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft. High Network Exploitable Tue, 15 Sep 2026 15:22:29 GMT https://vulnogram.org/CVE-2026-19486 https://vulnogram.org/CVE-2026-19486 A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service accoun… High Network Exploitable Fri, 11 Sep 2026 08:18:25 GMT https://vulnogram.org/CVE-2026-13745 https://vulnogram.org/CVE-2026-13745 A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overridin… High Network Exploitable Thu, 10 Sep 2026 08:33:09 GMT https://vulnogram.org/CVE-2026-79696 https://vulnogram.org/CVE-2026-79696 A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to exec… Critical Network Exploitable Wed, 09 Sep 2026 08:16:50 GMT https://vulnogram.org/CVE-2026-4644 https://vulnogram.org/CVE-2026-4644 A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauth… High Fri, 04 Sep 2026 10:19:13 GMT https://vulnogram.org/CVE-2026-79707 https://vulnogram.org/CVE-2026-79707 A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter. High Network Exploitable Fri, 04 Sep 2026 10:06:34 GMT https://vulnogram.org/CVE-2026-19410 https://vulnogram.org/CVE-2026-19410 An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This… Critical Mon, 31 Aug 2026 08:14:52 GMT https://vulnogram.org/CVE-2026-19485 https://vulnogram.org/CVE-2026-19485 A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write acces… Critical Wed, 26 Aug 2026 18:06:00 GMT https://vulnogram.org/CVE-2026-12717 https://vulnogram.org/CVE-2026-12717 An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the… Critical Cloud Hosted Wed, 26 Aug 2026 12:59:56 GMT https://vulnogram.org/CVE-2026-12710 https://vulnogram.org/CVE-2026-12710 A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no cu… Critical Network Exploitable Sat, 22 Aug 2026 08:13:00 GMT https://vulnogram.org/CVE-2026-15623 https://vulnogram.org/CVE-2026-15623 A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request para… Critical Cloud Hosted Mon, 17 Aug 2026 06:27:00 GMT https://vulnogram.org/CVE-2026-15587 https://vulnogram.org/CVE-2026-15587 Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication he… Critical Wed, 05 Aug 2026 14:40:11 GMT https://vulnogram.org/CVE-2026-15810 https://vulnogram.org/CVE-2026-15810 A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leadi… High Network Exploitable Fri, 24 Jul 2026 11:04:59 GMT https://vulnogram.org/CVE-2026-12715 https://vulnogram.org/CVE-2026-12715 Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vul… High Fri, 17 Jul 2026 15:09:49 GMT https://vulnogram.org/CVE-2026-14934 https://vulnogram.org/CVE-2026-14934 A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacke… Critical Mon, 13 Jul 2026 10:20:19 GMT https://vulnogram.org/CVE-2026-12879 https://vulnogram.org/CVE-2026-12879 An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 o… Medium Thu, 09 Jul 2026 12:56:51 GMT https://vulnogram.org/CVE-2026-12537 https://vulnogram.org/CVE-2026-12537 Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pr… Critical Network Exploitable Wed, 24 Jun 2026 13:37:21 GMT https://vulnogram.org/CVE-2026-8934 https://vulnogram.org/CVE-2026-8934 A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially c… Medium Network Exploitable Mon, 22 Jun 2026 15:20:05 GMT https://vulnogram.org/CVE-2026-4764 https://vulnogram.org/CVE-2026-4764 A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with specific roles to escalate privileges and potentially take over a GCP project using a maliciously c… Critical Cloud Hosted Thu, 11 Jun 2026 10:13:40 GMT https://vulnogram.org/CVE-2026-2264 https://vulnogram.org/CVE-2026-2264 A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially… Critical Network Exploitable Tue, 26 May 2026 16:30:45 GMT https://vulnogram.org/CVE-2026-2031 https://vulnogram.org/CVE-2026-2031 An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code us… Critical Network Exploitable Fri, 15 May 2026 15:38:24 GMT https://vulnogram.org/CVE-2026-7428 https://vulnogram.org/CVE-2026-7428 Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative a… Critical Network Exploitable Cloud Hosted Tue, 12 May 2026 09:16:35 GMT https://vulnogram.org/CVE-2026-3259 https://vulnogram.org/CVE-2026-3259 A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Platform allows an authenticated user to potentially disclose sensitive data using a crafted ma… High Thu, 23 Apr 2026 08:35:04 GMT https://vulnogram.org/CVE-2026-4810 https://vulnogram.org/CVE-2026-4810 A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitra… Critical Network Exploitable Cloud Hosted Mon, 13 Apr 2026 08:35:56 GMT https://vulnogram.org/CVE-2026-3136 https://vulnogram.org/CVE-2026-3136 An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no… High Network Exploitable Tue, 03 Mar 2026 16:22:54 GMT https://vulnogram.org/CVE-2026-2244 https://vulnogram.org/CVE-2026-2244 A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script. All instances after January 30th, 2026 have been… High Thu, 26 Feb 2026 14:14:46 GMT https://vulnogram.org/CVE-2026-2473 https://vulnogram.org/CVE-2026-2473 Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model… High Network Exploitable Cloud Hosted Fri, 20 Feb 2026 19:39:51 GMT https://vulnogram.org/CVE-2026-2472 https://vulnogram.org/CVE-2026-2472 Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitra… High Network Exploitable Cloud Hosted Fri, 20 Feb 2026 19:29:12 GMT https://vulnogram.org/CVE-2026-2274 https://vulnogram.org/CVE-2026-2274 A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker to read sensitive local files and access internal network resources via crafted requests to the production cl… High Thu, 19 Feb 2026 15:21:38 GMT https://vulnogram.org/CVE-2026-1727 https://vulnogram.org/CVE-2026-1727 The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and… Critical Network Exploitable Fri, 06 Feb 2026 21:44:42 GMT https://vulnogram.org/CVE-2025-13427 https://vulnogram.org/CVE-2025-13427 An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining access to the agents' knowledge and the ability to trigger their intents, by manipulating in… Medium Network Exploitable Thu, 18 Dec 2025 21:57:55 GMT https://vulnogram.org/CVE-2025-12952 https://vulnogram.org/CVE-2025-12952 A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. This allows the attacke… High Wed, 10 Dec 2025 07:11:31 GMT https://vulnogram.org/CVE-2025-9571 https://vulnogram.org/CVE-2025-9571 A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. This could allow the attacker to gai… High Wed, 10 Dec 2025 07:02:59 GMT https://vulnogram.org/CVE-2025-13428 https://vulnogram.org/CVE-2025-13428 A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution (RCE) in the server. The flaw stemmed from weak validation of uploaded Python package… High Tue, 09 Dec 2025 06:28:08 GMT https://vulnogram.org/CVE-2025-13292 https://vulnogram.org/CVE-2025-13292 A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was pat… High Sat, 06 Dec 2025 05:05:51 GMT https://vulnogram.org/CVE-2025-13426 https://vulnogram.org/CVE-2025-13426 A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious… High Fri, 05 Dec 2025 21:27:13 GMT https://vulnogram.org/CVE-2025-12742 https://vulnogram.org/CVE-2025-12742 A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Look… High Tue, 25 Nov 2025 05:38:47 GMT https://vulnogram.org/CVE-2025-12741 https://vulnogram.org/CVE-2025-12741 A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious command. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been… High Mon, 24 Nov 2025 11:35:33 GMT https://vulnogram.org/CVE-2025-12740 https://vulnogram.org/CVE-2025-12740 A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters. Looker-hosted and Self-hoste… High Mon, 24 Nov 2025 11:30:31 GMT https://vulnogram.org/CVE-2025-12739 https://vulnogram.org/CVE-2025-12739 An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and… High Mon, 24 Nov 2025 09:11:38 GMT https://vulnogram.org/CVE-2025-12414 https://vulnogram.org/CVE-2025-12414 An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Look… Critical Network Exploitable Thu, 20 Nov 2025 10:32:52 GMT https://vulnogram.org/CVE-2025-12743 https://vulnogram.org/CVE-2025-12743 The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL inject… Medium Wed, 19 Nov 2025 16:41:30 GMT https://vulnogram.org/CVE-2025-12472 https://vulnogram.org/CVE-2025-12472 An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulner… High Wed, 19 Nov 2025 10:27:56 GMT https://vulnogram.org/CVE-2025-12405 https://vulnogram.org/CVE-2025-12405 An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source… High Mon, 10 Nov 2025 09:27:45 GMT https://vulnogram.org/CVE-2025-12409 https://vulnogram.org/CVE-2025-12409 A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could exec… High Mon, 10 Nov 2025 08:59:15 GMT