CVE-2026-19407GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK Exploitation status Not confirmed Fix Affected product G Gemini Enterprise Agent Platform SDK for Python Published 09/15/2026 Severity High CVE-2026-19486SSRF in Gemini Enterprise Agent Platform App Builder Exploitation status Not known exploited Fix Affected product G Gemini Enterprise Agent Platform App Builder Published 09/11/2026 Severity High CVE-2026-13745Arbitrary Code Execution in Gemini CLI via Symlinked Environment Variables Exploitation status Not known exploited Fix Affected product G Gemini CLI Published 09/10/2026 Severity Critical CVE-2026-79696Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist Exploitation status Not known exploited Fix Affected product A Agent Development Kit (ADK) for Python Published 09/09/2026 Severity Critical CVE-2026-4644Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover Exploitation status Not known exploited Fix Affected product I Integration Connectors Published 09/04/2026 Severity High CVE-2026-79707Arbitrary File Read in Google Agent Development Kit (ADK) Exploitation status Not known exploited Fix Affected product A Agent Development Kit (ADK) Published 09/04/2026 Severity High CVE-2026-19410Google Cloud Build Comment Control Bypass via Webhook Suppression Exploitation status Not known exploited Fix Affected product G Google Cloud Build Published 08/31/2026 Severity Critical CVE-2026-19485Bucket Squatting in Vertex AI Search for Commerce Exploitation status Not known exploited Fix Affected product V Vertex AI Search for Commerce Published 08/26/2026 Severity Critical CVE-2026-12717Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection Exploitation status Not known exploited Fix Affected product B BigQuery Data Transfer Service Published 08/26/2026 Severity Critical CVE-2026-12710Missing Authorization in Application Integration QueryEngineTask Exploitation status Not known exploited Fix Affected product A Application Integration Published 08/22/2026 Severity Critical CVE-2026-15623Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service Exploitation status Not known exploited Fix Affected product G Google SecOps (Chronicle SOAR) Published 08/17/2026 Severity Critical CVE-2026-15587Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header Exploitation status Not known exploited Fix Affected product G Google SecOps (Chronicle SOAR) Published 08/05/2026 Severity Critical CVE-2026-15810Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover Exploitation status Not known exploited Fix Affected product L Looker Published 07/24/2026 Severity High CVE-2026-12715Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft Exploitation status Not known exploited Fix Affected product F Firebase Studio Published 07/17/2026 Severity High CVE-2026-14934Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise Exploitation status Not known exploited Fix Affected product B BigQuery Published 07/13/2026 Severity Critical CVE-2026-12879Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy Exploitation status Not known exploited Fix Affected product A Apigee Published 07/09/2026 Severity Medium CVE-2026-12537Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows Exploitation status Not known exploited Fix Affected product G Gemini CLI Published 06/24/2026 Severity Critical CVE-2026-8934Cross-Project Information Leakage in Google App Engine UI Exploitation status Not known exploited Fix Affected product C Cloud Console UIs Published 06/22/2026 Severity Medium CVE-2026-4764Privilege Escalation in Dialogflow CX via Playbook Import Exploitation status Not known exploited Fix Affected product D Dialogflow CX Published 06/11/2026 Severity Critical CVE-2026-2264Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy. Exploitation status Not known exploited Fix Affected product A Apigee-X Published 05/26/2026 Severity Critical CVE-2026-2031Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution. Exploitation status Not known exploited Fix Affected product I Internal Integration Platform APIs Published 05/15/2026 Severity Critical CVE-2026-7428Insecure default administrative credentials in AlloyDB for PostgreSQL Exploitation status Not known exploited Fix Affected product A AlloyDB for PostgreSQL Published 05/12/2026 Severity Critical CVE-2026-3259Sensitive Data Disclosure in BigQuery via Materialized View Error Messages Exploitation status Not known exploited Fix Affected product B BigQuery Published 04/23/2026 Severity High CVE-2026-4810Remote Code Execution in Google Agent Development Kit (ADK) Exploitation status Not known exploited Fix Affected product A Agent Development Kit (ADK) Published 04/13/2026 Severity Critical CVE-2026-3136Google Cloud Build Comment Control Bypass Exploitation status Not known exploited Fix Affected product C Cloud Build Published 03/03/2026 Severity High CVE-2026-2244Sensitive Data Exposure in Google Cloud Vertex AI Workbench Exploitation status Not known exploited Fix Affected product V Vertex AI Workbench Published 02/26/2026 Severity High CVE-2026-2473Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft. Exploitation status Not known exploited Fix Affected product V Vertex AI Experiments Published 02/20/2026 Severity High CVE-2026-2472Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization Exploitation status Not known exploited Fix Affected product V Vertex AI SDK for Python Published 02/20/2026 Severity High CVE-2026-1727Information Disclosure via Bucket Squatting in Google Cloud Agentspace. Exploitation status Not known exploited Fix Affected product G Gemini Enterprise (formerly Agentspace) Published 02/06/2026 Severity Critical CVE-2025-13427Authentication Bypass in Dialogflow CX Messenger Exploitation status Not known exploited Fix Affected product D Dialogflow CX Messenger Published 12/18/2025 Severity Medium CVE-2025-12952Privilege Escalation in Dialogflow CX via Webhook Admin Role Exploitation status Not known exploited Fix Affected product D Dialogflow CX Published 12/10/2025 Severity High CVE-2025-9571Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload Exploitation status Not known exploited Fix Affected product C Cloud Data Fusion Published 12/10/2025 Severity High CVE-2025-13428RCE in SecOps SOAR server via user-provided Python packages Exploitation status Not known exploited Fix Affected product G Google Cloud SecOps SOAR Published 12/09/2025 Severity High CVE-2025-13292Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access. Exploitation status Not known exploited Fix Affected product A Apigee-X Published 12/06/2025 Severity High CVE-2025-13426Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution Exploitation status Not known exploited Fix Affected product A Apigee hybrid Javacallout policy Published 12/05/2025 Severity High CVE-2025-12742Remote Code Execution in Looker via Teradata JDBC Driver Exploitation status Not known exploited Fix Affected product L Looker Published 11/25/2025 Severity High CVE-2025-12741Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution Exploitation status Not known exploited Fix Affected product L Looker Published 11/24/2025 Severity High CVE-2025-12740Remote Command Execution in Looker via IBM DB2 JDBC drive Exploitation status Not known exploited Fix Affected product L Looker Published 11/24/2025 Severity High CVE-2025-12739Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise Exploitation status Not known exploited Fix Affected product L Looker Published 11/24/2025 Severity High CVE-2025-12414Looker account compromise via punycode homograph attack Exploitation status Not known exploited Fix Affected product L Looker Published 11/20/2025 Severity Critical CVE-2025-12743SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database Exploitation status Not known exploited Fix Affected product L Looker Published 11/19/2025 Severity Medium CVE-2025-12472Remote Code Execution in Looker due to Improperly Validated Directory Deletion Exploitation status Not known exploited Fix Affected product L Looker Published 11/19/2025 Severity High CVE-2025-12405Unauthorized access through stored credentials in Looker Studio Exploitation status Not known exploited Fix Affected product L Looker Studio Published 11/10/2025 Severity High CVE-2025-12409SQL Injection in Looker Studio Exploitation status Not known exploited Fix Affected product L Looker Studio Published 11/10/2025 Severity High CVE-2025-12397SQL Injection in Looker Studio Exploitation status Not known exploited Fix Affected product L Looker Studio Published 11/10/2025 Severity High CVE-2025-12155Command Injection in Looker Exploitation status Not known exploited Fix Affected product L Looker Published 11/10/2025 Severity High CVE-2025-11915HTTP Desynchronisation in Vertex AI for certain third-party models Exploitation status Not known exploited Fix Affected product V Vertex AI: Partner Models for MaaS Published 10/22/2025 Severity Medium CVE-2025-9918Zip Slip in Google SecOps SOAR allows for Remote Code Execution Exploitation status Not known exploited Fix Affected product G Google SecOps SOAR Published 09/11/2025 Severity High CVE-2025-9118Dataform Path Traversal Exploitation status Not known exploited Fix Affected product D Dataform Published 08/25/2025 Severity Critical CVE-2025-4600HTTP Request Smuggling in Google Cloud Classic Application Load Balancer due to Improper Chunked Encoding Validation Exploitation status Not known exploited Fix Affected product C Classic Application Load Balancer Published 05/16/2025 Severity High CVE-2025-0982Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine) Exploitation status Not known exploited Fix Not confirmed Affected product A Application Integration Published 02/06/2025 Severity Critical CVE-2024-9858Insecure user permissions in Google Cloud Migrate to Containers for Windows Exploitation status Not known exploited Fix Affected product M Migrate to Containers Published 10/16/2024 Severity Medium CVE-2024-5166Insecure Direct Object Reference In Looker Exploitation status Not known exploited Fix Not confirmed Affected product L Looker Published 05/22/2024 Severity Medium 
%20for%20Python.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
