Google Cloud vulnerabilities
63 CVEs and advisories name Google Cloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-93327Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
- CVE-2026-85268Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
- CVE-2026-85299Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
- CVE-2026-85297Bucket Squatting in Cloud Run MCP leads to Service Account Takeover
- CVE-2026-93328Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
- CVE-2026-85267Cross-Site WebSocket Hijacking in Google Cloud Shell
- CVE-2026-85298Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
- CVE-2026-81375Confused Deputy in Application Integration allows Internal File Read
- CVE-2026-81867Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
- CVE-2026-19759Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
- CVE-2026-19407GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
- CVE-2026-19486SSRF in Gemini Enterprise Agent Platform App Builder
- CVE-2026-13745Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME
- CVE-2026-79696Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
- CVE-2026-4644Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover
- CVE-2026-79707Arbitrary File Read in Google Agent Development Kit (ADK)
- CVE-2026-19410Google Cloud Build Comment Control Bypass via Webhook Suppression
- CVE-2026-19485Bucket Squatting in Vertex AI Search for Commerce
- CVE-2026-12717Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
- CVE-2026-12710Missing Authorization in Application Integration QueryEngineTask
- CVE-2026-15623Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
- CVE-2026-15587Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header
- CVE-2026-15810Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
- CVE-2026-12715Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft
- CVE-2026-14934Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
- CVE-2026-12879Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy
- CVE-2026-12537Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
- CVE-2026-8934Cross-Project Information Leakage in Google App Engine UI
- CVE-2026-4764Privilege Escalation in Dialogflow CX via Playbook Import
- CVE-2026-2264Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.