Google Cloud CVEs
103 vulnerabilities mapped to Google Cloud’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-109619 RCE via stale global state
CVSS 8.1 highEPSS 100.0%14 incidents
CVE-2026-109618 RCE via OOM corruption
CVSS 9.8 criticalEPSS 100.0%15 incidents
CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
Not scoredEPSS 0.30%2 incidents
CVE-2026-85267 Cross-Site WebSocket Hijacking in Google Cloud Shell
CVSS 8.7 highEPSS 0.21%
CVE-2026-81375 Confused Deputy in Application Integration allows Internal File Read
CVSS 8.3 highEPSS 0.32%
CVE-2026-81867 Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
CVSS 9.4 criticalEPSS 0.36%
CVE-2026-19759 Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
CVSS 9.4 criticalEPSS 0.23%
CVE-2026-73553 Envoy: RBAC Authorization Bypass via Path Parameters
CVSS 7.5 highEPSS 0.51%
CVE-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters
CVSS 5.3 mediumEPSS 0.53%
CVE-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
CVSS 7.4 highEPSS 0.62%
CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects
CVSS 7.5 highEPSS 0.87%
CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
CVSS 7.5 highEPSS 0.55%
CVE-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
CVSS 7.5 highEPSS 0.55%
CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling
CVSS 7.5 highEPSS 0.49%
CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
CVSS 7.5 highEPSS 0.49%
CVE-2026-50572 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
CVSS 5.9 mediumEPSS 0.68%
CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
CVSS 7.7 highEPSS 0.67%
CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder
CVSS 8.7 highEPSS 0.42%
CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
CVSS 10.0 criticalEPSS 0.74%
CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)
CVSS 8.7 highEPSS 0.67%
CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression
CVSS 9.4 criticalEPSS 0.20%
CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
CVSS 9.3 criticalEPSS 0.38%
CVE-2026-12717 Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
CVSS 9.4 criticalEPSS 0.62%
CVE-2026-12710 Missing Authorization in Application Integration QueryEngineTask
CVSS 9.3 criticalEPSS 0.41%
CVE-2026-59310 vCenter directory-traversal vulnerability
CVSS 9.8 criticalKEV added EPSS 2.6%
CVE-2026-15623 Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
CVSS 9.4 criticalEPSS 0.34%
CVSS 5.3 mediumEPSS 0.10%
CVSS 4.5 mediumEPSS 0.10%
CVSS 4.3 mediumEPSS 0.09%
CVSS 5.6 mediumEPSS 0.07%
CVSS 7.2 highEPSS 0.13%
CVSS 7.2 highEPSS 0.15%
CVSS 5.3 mediumEPSS 0.12%
CVSS 4.5 mediumEPSS 0.10%
CVSS 5.3 mediumEPSS 0.13%
CVE-2026-6726 An information leakage vulnerability in the TCG TPM 2.0 reference code.
CVSS 7.9 highEPSS 0.19%
CVE-2026-15587 Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header
CVSS 9.4 criticalEPSS 0.23%
CVE-2026-64561 KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
CVSS 8.8 highEPSS 0.27%
CVE-2026-41709 ESX insufficient logging vulnerability
CVSS 2.7 lowEPSS 0.30%
CVE-2026-41703 Out-of-bounds read vulnerability
CVSS 7.6 highEPSS 0.43%
CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability
CVSS 9.3 criticalEPSS 0.19%
CVE-2026-59309 vCenter authentication-bypass vulnerability
CVSS 9.8 criticalEPSS 0.61%
CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
CVSS 8.7 highEPSS 0.45%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)