GC
Vendor
Google Cloud
66
CVEs
0
On KEV
5
New 30D
Products
AI10.0
Application Integration
Google Cloud
6 CVEs0 on KEV1 new
MT9.3
MCP Toolbox for Databases (googleapis/mcp-toolbox)
Google Cloud
1 CVEs0 on KEV1 new
CR7.7
Cloud Run MCP
Google Cloud
1 CVEs0 on KEV1 new
CS8.7
Cloud Shell
Google Cloud
1 CVEs0 on KEV1 new
CE8.3
Compute Engine
Google Cloud
1 CVEs0 on KEV1 new
LO9.2
Looker
Google Cloud
10 CVEs0 on KEV0 new
LS7.7
Looker Studio
Google Cloud
3 CVEs0 on KEV0 new
AD9.3
Agent Development Kit (ADK)
Google Cloud
2 CVEs0 on KEV0 new
AP9.2
Apigee-X
Google Cloud
2 CVEs0 on KEV0 new
BI9.4
BigQuery
Google Cloud
2 CVEs0 on KEV0 new
DA10.0
Dataform
Google Cloud
2 CVEs0 on KEV0 new
DC9.4
Dialogflow CX
Google Cloud
2 CVEs0 on KEV0 new
GC7.8
Gemini CLI
Google Cloud
2 CVEs0 on KEV0 new
GS9.4
Google SecOps (Chronicle SOAR)
Google Cloud
2 CVEs0 on KEV0 new
AD10.0
Agent Development Kit (ADK) for Python
Google Cloud
1 CVEs0 on KEV0 new
AF9.2
AlloyDB for PostgreSQL
Google Cloud
1 CVEs0 on KEV0 new
AP5.9
Apigee
Google Cloud
1 CVEs0 on KEV0 new
AH8.7
Apigee hybrid Javacallout policy
Google Cloud
1 CVEs0 on KEV0 new
BD9.4
BigQuery Data Transfer Service
Google Cloud
1 CVEs0 on KEV0 new
CA7.5
Classic Application Load Balancer
Google Cloud
1 CVEs0 on KEV0 new
CB9.8
Cloud Build
Google Cloud
1 CVEs0 on KEV0 new
CC6.9
Cloud Console UIs
Google Cloud
1 CVEs0 on KEV0 new
CD8.7
Cloud Data Fusion
Google Cloud
1 CVEs0 on KEV0 new
CE9.4
Colab Enterprise
Google Cloud
1 CVEs0 on KEV0 new
DC6.9
Dialogflow CX Messenger
Google Cloud
1 CVEs0 on KEV0 new
FS8.5
Firebase Studio
Google Cloud
1 CVEs0 on KEV0 new
GE8.7
Gemini Enterprise Agent Platform App Builder
Google Cloud
1 CVEs0 on KEV0 new
GE7.7
Gemini Enterprise Agent Platform SDK for Python
Google Cloud
1 CVEs0 on KEV0 new
GE9.1
Gemini Enterprise (formerly Agentspace)
Google Cloud
1 CVEs0 on KEV0 new
GC9.4
Google Cloud Build
Google Cloud
1 CVEs0 on KEV0 new
GC7.2
Google Cloud SecOps SOAR
Google Cloud
1 CVEs0 on KEV0 new
GS8.7
Google SecOps SOAR
Google Cloud
1 CVEs0 on KEV0 new
IC8.5
Integration Connectors
Google Cloud
1 CVEs0 on KEV0 new
II10.0
Internal Integration Platform APIs
Google Cloud
1 CVEs0 on KEV0 new
MT7.8
Migrate to Containers
Google Cloud
1 CVEs0 on KEV0 new
RG7.8
run-gemini-cli GitHub Action
Google Cloud
1 CVEs0 on KEV0 new
VA7.7
Vertex AI Experiments
Google Cloud
1 CVEs0 on KEV0 new
VA6.9
Vertex AI: Open Models for MaaS
Google Cloud
1 CVEs0 on KEV0 new
VA6.9
Vertex AI: Partner Models for MaaS
Google Cloud
1 CVEs0 on KEV0 new
VA8.1
Vertex AI SDK for Python
Google Cloud
1 CVEs0 on KEV0 new
VA9.3
Vertex AI Search for Commerce
Google Cloud
1 CVEs0 on KEV0 new
VA6.9
Vertex AI: Self-Deployed Models
Google Cloud
1 CVEs0 on KEV0 new
VA8.4
Vertex AI Workbench
Google Cloud
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85299 New | CE Compute Engine Google Cloud | 8.3 | Oct 27 | Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration |
| CVE-2026-85297 New | CR Cloud Run MCP Google Cloud | 7.7 | Oct 26 | Bucket Squatting in Cloud Run MCP leads to Service Account Takeover |
| CVE-2026-93328 New | MT MCP Toolbox for Databases (googleapis/mcp-toolbox) Google Cloud | 9.3 | Oct 26 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write |
| CVE-2026-85267 | CS Cloud Shell Google Cloud | 8.7 | Oct 20 | Cross-Site WebSocket Hijacking in Google Cloud Shell |
| CVE-2026-85298 | AI Application Integration Google Cloud | 7.3 | Oct 14 | Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation |
| CVE-2026-81375 | AI Application Integration Google Cloud | 8.3 | Sep 28 | Confused Deputy in Application Integration allows Internal File Read |
| CVE-2026-81867 | AI Application Integration Google Cloud | 9.4 | Sep 28 | Deserialization of Untrusted Data in Application Integration allows Remote Code Execution |
| CVE-2026-19759 | AI Application Integration Google Cloud | 9.4 | Sep 28 | Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution |
| CVE-2026-19407 | GE Gemini Enterprise Agent Platform SDK for Python Google Cloud | 7.7 | Sep 15 | GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK |
| CVE-2026-19486 | GE Gemini Enterprise Agent Platform App Builder Google Cloud | 8.7 | Sep 11 | SSRF in Gemini Enterprise Agent Platform App Builder |
| CVE-2026-13745 | GC Gemini CLI Google Cloud | 7.7 | Sep 10 | Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME |
| CVE-2026-79696 | AD Agent Development Kit (ADK) for Python Google Cloud | 10.0 | Sep 9 | Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist |
| CVE-2026-4644 | IC Integration Connectors Google Cloud | 8.5 | Sep 4 | Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover |
| CVE-2026-79707 | AD Agent Development Kit (ADK) Google Cloud | 8.7 | Sep 4 | Arbitrary File Read in Google Agent Development Kit (ADK) |
| CVE-2026-19410 | GC Google Cloud Build Google Cloud | 9.4 | Aug 31 | Google Cloud Build Comment Control Bypass via Webhook Suppression |
| CVE-2026-19485 | VA Vertex AI Search for Commerce Google Cloud | 9.3 | Aug 26 | Bucket Squatting in Vertex AI Search for Commerce |
| CVE-2026-12717 | BD BigQuery Data Transfer Service Google Cloud | 9.4 | Aug 26 | Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection |
| CVE-2026-12710 | AI Application Integration Google Cloud | 9.3 | Aug 22 | Missing Authorization in Application Integration QueryEngineTask |
| CVE-2026-15623 | GS Google SecOps (Chronicle SOAR) Google Cloud | 9.4 | Aug 17 | Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service |
| CVE-2026-15587 | GS Google SecOps (Chronicle SOAR) Google Cloud | 9.4 | Aug 5 | Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header |
| CVE-2026-15810 | LO Looker Google Cloud | 8.7 | Jul 24 | Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover |
| CVE-2026-12715 | FS Firebase Studio Google Cloud | 8.5 | Jul 17 | Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft |
| CVE-2026-14934 | CE Colab Enterprise Google Cloud | 9.4 | Jul 13 | Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise |
| CVE-2026-12879 | AP Apigee Google Cloud | 5.9 | Jul 9 | Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy |
| CVE-2026-12537 | GC Gemini CLI Google Cloud | 7.8 | Jun 24 | Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows |
| CVE-2026-8934 | CC Cloud Console UIs Google Cloud | 6.9 | Jun 22 | Cross-Project Information Leakage in Google App Engine UI |
| CVE-2026-4764 | DC Dialogflow CX Google Cloud | 9.4 | Jun 11 | Privilege Escalation in Dialogflow CX via Playbook Import |
| CVE-2026-2264 | AP Apigee-X Google Cloud | 9.2 | May 26 | Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy. |
| CVE-2026-2031 | II Internal Integration Platform APIs Google Cloud | 10.0 | May 15 | Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution. |
| CVE-2026-7428 | AF AlloyDB for PostgreSQL Google Cloud | 9.2 | May 12 | Insecure default administrative credentials in AlloyDB for PostgreSQL |
| CVE-2026-3259 | BI BigQuery Google Cloud | 7.1 | Apr 23 | Sensitive Data Disclosure in BigQuery via Materialized View Error Messages |
| CVE-2026-4810 | AD Agent Development Kit (ADK) Google Cloud | 9.3 | Apr 13 | Remote Code Execution in Google Agent Development Kit (ADK) |
| CVE-2026-3136 | CB Cloud Build Google Cloud | 9.8 | Mar 3 | Google Cloud Build Comment Control Bypass |
| CVE-2026-2244 | VA Vertex AI Workbench Google Cloud | 8.4 | Feb 26 | Sensitive Data Exposure in Google Cloud Vertex AI Workbench |
| CVE-2026-2473 | VA Vertex AI Experiments Google Cloud | 7.7 | Feb 20 | Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft. |
| CVE-2026-2472 | VA Vertex AI SDK for Python Google Cloud | 8.1 | Feb 20 | Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization |
| CVE-2026-1727 | GE Gemini Enterprise (formerly Agentspace) Google Cloud | 9.1 | Feb 6 | Information Disclosure via Bucket Squatting in Google Cloud Agentspace. |
| CVE-2025-13427 | DC Dialogflow CX Messenger Google Cloud | 6.9 | Dec 18 | Authentication Bypass in Dialogflow CX Messenger |
| CVE-2025-12952 | DC Dialogflow CX Google Cloud | 8.7 | Dec 10 | Privilege Escalation in Dialogflow CX via Webhook Admin Role |
| CVE-2025-9571 | CD Cloud Data Fusion Google Cloud | 8.7 | Dec 10 | Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload |
| CVE-2025-13428 | GC Google Cloud SecOps SOAR Google Cloud | 7.2 | Dec 9 | RCE in SecOps SOAR server via user-provided Python packages |
| CVE-2025-13292 | AP Apigee-X Google Cloud | 7.6 | Dec 6 | Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access. |
| CVE-2025-13426 | AH Apigee hybrid Javacallout policy Google Cloud | 8.7 | Dec 5 | Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution |
| CVE-2025-12742 | LO Looker Google Cloud | 7.5 | Nov 25 | Remote Code Execution in Looker via Teradata JDBC Driver |
| CVE-2025-12741 | LO Looker Google Cloud | 7.7 | Nov 24 | Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution |
| CVE-2025-12740 | LO Looker Google Cloud | 7.7 | Nov 24 | Remote Command Execution in Looker via IBM DB2 JDBC drive |
| CVE-2025-12739 | LO Looker Google Cloud | 7.3 | Nov 24 | Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise |
| CVE-2025-12414 | LO Looker Google Cloud | 9.2 | Nov 20 | Looker account compromise via punycode homograph attack |
| CVE-2025-12743 | LO Looker Google Cloud | 6.0 | Nov 19 | SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database |
| CVE-2025-12472 | LO Looker Google Cloud | 7.1 | Nov 19 | Remote Code Execution in Looker due to Improperly Validated Directory Deletion |
| CVE-2025-12405 | LS Looker Studio Google Cloud | 7.7 | Nov 10 | Unauthorized access through stored credentials in Looker Studio |
| CVE-2025-12409 | LS Looker Studio Google Cloud | 7.3 | Nov 10 | SQL Injection in Looker Studio |
| CVE-2025-12397 | LS Looker Studio Google Cloud | 7.6 | Nov 10 | SQL Injection in Looker Studio |
| CVE-2025-12155 | LO Looker Google Cloud | 7.1 | Nov 10 | Command Injection in Looker |
| CVE-2025-11915 | VA Vertex AI: Partner Models for MaaS Google Cloud | 6.9 | Oct 22 | HTTP Desynchronisation in Vertex AI for certain third-party models |
| CVE-2025-9918 | GS Google SecOps SOAR Google Cloud | 8.7 | Sep 11 | Zip Slip in Google SecOps SOAR allows for Remote Code Execution |
| CVE-2025-9118 | DA Dataform Google Cloud | 10.0 | Aug 25 | Dataform Path Traversal |
| CVE-2025-4600 | CA Classic Application Load Balancer Google Cloud | 7.5 | May 16 | HTTP Request Smuggling in Google Cloud Classic Application Load Balancer due to Improper Chunked Encoding Validation |
| CVE-2025-0982 | AI Application Integration Google Cloud | 10.0 | Feb 6 | Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine) |
| CVE-2024-9858 | MT Migrate to Containers Google Cloud | 7.8 | Oct 16 | Insecure user permissions in Google Cloud Migrate to Containers for Windows |