# cve.now: Google Cloud

The newest entries naming Google Cloud as an affected vendor (up to 200), of 63 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-93327](https://cve.now/CVE-2026-93327.md): Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution (CVSS 9.4)
- [CVE-2026-85268](https://cve.now/CVE-2026-85268.md): Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID (CVSS 8.7)
- [CVE-2026-85299](https://cve.now/CVE-2026-85299.md): Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration (CVSS 8.3)
- [CVE-2026-85297](https://cve.now/CVE-2026-85297.md): Bucket Squatting in Cloud Run MCP leads to Service Account Takeover (CVSS 7.7)
- [CVE-2026-93328](https://cve.now/CVE-2026-93328.md): Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write (CVSS 9.3)
- [CVE-2026-85267](https://cve.now/CVE-2026-85267.md): Cross-Site WebSocket Hijacking in Google Cloud Shell (CVSS 8.7)
- [CVE-2026-85298](https://cve.now/CVE-2026-85298.md): Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation (CVSS 7.3)
- [CVE-2026-81375](https://cve.now/CVE-2026-81375.md): Confused Deputy in Application Integration allows Internal File Read (CVSS 8.3)
- [CVE-2026-81867](https://cve.now/CVE-2026-81867.md): Deserialization of Untrusted Data in Application Integration allows Remote Code Execution (CVSS 9.4)
- [CVE-2026-19759](https://cve.now/CVE-2026-19759.md): Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution (CVSS 9.4)
- [CVE-2026-19407](https://cve.now/CVE-2026-19407.md): GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK (CVSS 7.7)
- [CVE-2026-19486](https://cve.now/CVE-2026-19486.md): SSRF in Gemini Enterprise Agent Platform App Builder (CVSS 8.7)
- [CVE-2026-13745](https://cve.now/CVE-2026-13745.md): Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI\_CLI\_HOME (CVSS 7.7)
- [CVE-2026-79696](https://cve.now/CVE-2026-79696.md): Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist (CVSS 10.0)
- [CVE-2026-4644](https://cve.now/CVE-2026-4644.md): Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover (CVSS 8.5)
- [CVE-2026-79707](https://cve.now/CVE-2026-79707.md): Arbitrary File Read in Google Agent Development Kit (ADK) (CVSS 8.7)
- [CVE-2026-19410](https://cve.now/CVE-2026-19410.md): Google Cloud Build Comment Control Bypass via Webhook Suppression (CVSS 9.4)
- [CVE-2026-19485](https://cve.now/CVE-2026-19485.md): Bucket Squatting in Vertex AI Search for Commerce (CVSS 9.3)
- [CVE-2026-12717](https://cve.now/CVE-2026-12717.md): Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection (CVSS 9.4)
- [CVE-2026-12710](https://cve.now/CVE-2026-12710.md): Missing Authorization in Application Integration QueryEngineTask (CVSS 9.3)
- [CVE-2026-15623](https://cve.now/CVE-2026-15623.md): Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service (CVSS 9.4)
- [CVE-2026-15587](https://cve.now/CVE-2026-15587.md): Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header (CVSS 9.4)
- [CVE-2026-15810](https://cve.now/CVE-2026-15810.md): Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover (CVSS 8.7)
- [CVE-2026-12715](https://cve.now/CVE-2026-12715.md): Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft (CVSS 8.5)
- [CVE-2026-14934](https://cve.now/CVE-2026-14934.md): Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise (CVSS 9.4)
- [CVE-2026-12879](https://cve.now/CVE-2026-12879.md): Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy (CVSS 5.9)
- [CVE-2026-12537](https://cve.now/CVE-2026-12537.md): Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows (CVSS 10.0)
- [CVE-2026-8934](https://cve.now/CVE-2026-8934.md): Cross-Project Information Leakage in Google App Engine UI (CVSS 6.9)
- [CVE-2026-4764](https://cve.now/CVE-2026-4764.md): Privilege Escalation in Dialogflow CX via Playbook Import (CVSS 9.4)
- [CVE-2026-2264](https://cve.now/CVE-2026-2264.md): Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy. (CVSS 9.2)
- [CVE-2026-2031](https://cve.now/CVE-2026-2031.md): Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution. (CVSS 10.0)
- [CVE-2026-7428](https://cve.now/CVE-2026-7428.md): Insecure default administrative credentials in AlloyDB for PostgreSQL (CVSS 9.2)
- [CVE-2026-3259](https://cve.now/CVE-2026-3259.md): Sensitive Data Disclosure in BigQuery via Materialized View Error Messages (CVSS 7.1)
- [CVE-2026-4810](https://cve.now/CVE-2026-4810.md): Remote Code Execution in Google Agent Development Kit (ADK) (CVSS 9.3)
- [CVE-2026-3136](https://cve.now/CVE-2026-3136.md): Google Cloud Build Comment Control Bypass (CVSS 8.6)
- [CVE-2026-2244](https://cve.now/CVE-2026-2244.md): Sensitive Data Exposure in Google Cloud Vertex AI Workbench (CVSS 8.4)
- [CVE-2026-2473](https://cve.now/CVE-2026-2473.md): Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft. (CVSS 7.7)
- [CVE-2026-2472](https://cve.now/CVE-2026-2472.md): Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization (CVSS 8.6)
- [CVE-2026-1727](https://cve.now/CVE-2026-1727.md): Information Disclosure via Bucket Squatting in Google Cloud Agentspace. (CVSS 9.1)
- [CVE-2025-13427](https://cve.now/CVE-2025-13427.md): Authentication Bypass in Dialogflow CX Messenger (CVSS 6.9)
- [CVE-2025-12952](https://cve.now/CVE-2025-12952.md): Privilege Escalation in Dialogflow CX via Webhook Admin Role (CVSS 8.7)
- [CVE-2025-9571](https://cve.now/CVE-2025-9571.md): Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload (CVSS 8.7)
- [CVE-2025-13428](https://cve.now/CVE-2025-13428.md): RCE in SecOps SOAR server via user-provided Python packages (CVSS 8.6)
- [CVE-2025-13292](https://cve.now/CVE-2025-13292.md): Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access. (CVSS 7.6)
- [CVE-2025-13426](https://cve.now/CVE-2025-13426.md): Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution (CVSS 8.7)
- [CVE-2025-12742](https://cve.now/CVE-2025-12742.md): Remote Code Execution in Looker via Teradata JDBC Driver (CVSS 7.5)
- [CVE-2025-12741](https://cve.now/CVE-2025-12741.md): Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution (CVSS 7.7)
- [CVE-2025-12740](https://cve.now/CVE-2025-12740.md): Remote Command Execution in Looker via IBM DB2 JDBC drive (CVSS 7.7)
- [CVE-2025-12739](https://cve.now/CVE-2025-12739.md): Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise (CVSS 7.3)
- [CVE-2025-12414](https://cve.now/CVE-2025-12414.md): Looker account compromise via punycode homograph attack (CVSS 9.2)
- [CVE-2025-12743](https://cve.now/CVE-2025-12743.md): SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database (CVSS 6.0)
- [CVE-2025-12472](https://cve.now/CVE-2025-12472.md): Remote Code Execution in Looker due to Improperly Validated Directory Deletion (CVSS 7.1)
- [CVE-2025-12405](https://cve.now/CVE-2025-12405.md): Unauthorized access through stored credentials in Looker Studio (CVSS 7.7)
- [CVE-2025-12409](https://cve.now/CVE-2025-12409.md): SQL Injection in Looker Studio (CVSS 7.3)
- [CVE-2025-12397](https://cve.now/CVE-2025-12397.md): SQL Injection in Looker Studio (CVSS 7.6)
- [CVE-2025-12155](https://cve.now/CVE-2025-12155.md): Command Injection in Looker (CVSS 7.1)
- [CVE-2025-11915](https://cve.now/CVE-2025-11915.md): HTTP Desynchronisation in Vertex AI for certain third-party models (CVSS 6.9)
- [CVE-2025-9918](https://cve.now/CVE-2025-9918.md): Zip Slip in Google SecOps SOAR allows for Remote Code Execution (CVSS 8.7)
- [CVE-2025-9118](https://cve.now/CVE-2025-9118.md): Dataform Path Traversal (CVSS 10.0)
- [CVE-2025-4600](https://cve.now/CVE-2025-4600.md): HTTP Request Smuggling in Google Cloud Classic Application Load Balancer due to Improper Chunked Encoding Validation (CVSS 8.7)
- [CVE-2025-0982](https://cve.now/CVE-2025-0982.md): Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine) (CVSS 9.4)
- [CVE-2024-9858](https://cve.now/CVE-2024-9858.md): Insecure user permissions in Google Cloud Migrate to Containers for Windows (CVSS 5.9)
- [CVE-2024-5166](https://cve.now/CVE-2024-5166.md): Insecure Direct Object Reference In Looker (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/google-cloud
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.