Google Cloud vulnerabilities
63 CVEs and advisories name Google Cloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-2031Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.
- CVE-2026-7428Insecure default administrative credentials in AlloyDB for PostgreSQL
- CVE-2026-3259Sensitive Data Disclosure in BigQuery via Materialized View Error Messages
- CVE-2026-4810Remote Code Execution in Google Agent Development Kit (ADK)
- CVE-2026-3136Google Cloud Build Comment Control Bypass
- CVE-2026-2244Sensitive Data Exposure in Google Cloud Vertex AI Workbench
- CVE-2026-2473Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.
- CVE-2026-2472Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization
- CVE-2026-1727Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
- CVE-2025-13427Authentication Bypass in Dialogflow CX Messenger
- CVE-2025-12952Privilege Escalation in Dialogflow CX via Webhook Admin Role
- CVE-2025-9571Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload
- CVE-2025-13428RCE in SecOps SOAR server via user-provided Python packages
- CVE-2025-13292Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.
- CVE-2025-13426Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution
- CVE-2025-12742Remote Code Execution in Looker via Teradata JDBC Driver
- CVE-2025-12741Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution
- CVE-2025-12740Remote Command Execution in Looker via IBM DB2 JDBC drive
- CVE-2025-12739Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise
- CVE-2025-12414Looker account compromise via punycode homograph attack
- CVE-2025-12743SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database
- CVE-2025-12472Remote Code Execution in Looker due to Improperly Validated Directory Deletion
- CVE-2025-12405Unauthorized access through stored credentials in Looker Studio
- CVE-2025-12409SQL Injection in Looker Studio
- CVE-2025-12397SQL Injection in Looker Studio
- CVE-2025-12155Command Injection in Looker
- CVE-2025-11915HTTP Desynchronisation in Vertex AI for certain third-party models
- CVE-2025-9918Zip Slip in Google SecOps SOAR allows for Remote Code Execution
- CVE-2025-9118Dataform Path Traversal
- CVE-2025-4600HTTP Request Smuggling in Google Cloud Classic Application Load Balancer due to Improper Chunked Encoding Validation