Google Cloud CVEs
26 matching vulnerabilities mapped to Google Cloud’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-109618 RCE via OOM corruption
CVSS 9.8 criticalEPSS 100.0%15 incidents
CVE-2026-81867 Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
CVSS 9.4 criticalEPSS 0.36%
CVE-2026-19759 Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
CVSS 9.4 criticalEPSS 0.23%
CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
CVSS 10.0 criticalEPSS 0.74%
CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression
CVSS 9.4 criticalEPSS 0.20%
CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
CVSS 9.3 criticalEPSS 0.38%
CVE-2026-12717 Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
CVSS 9.4 criticalEPSS 0.62%
CVE-2026-12710 Missing Authorization in Application Integration QueryEngineTask
CVSS 9.3 criticalEPSS 0.41%
CVE-2026-59310 vCenter directory-traversal vulnerability
CVSS 9.8 criticalKEV added EPSS 2.6%
CVE-2026-15623 Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
CVSS 9.4 criticalEPSS 0.34%
CVE-2026-15587 Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header
CVSS 9.4 criticalEPSS 0.23%
CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability
CVSS 9.3 criticalEPSS 0.19%
CVE-2026-59309 vCenter authentication-bypass vulnerability
CVSS 9.8 criticalEPSS 0.61%
CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
CVSS 9.6 criticalEPSS 0.35%
CVE-2026-50195 containerd: CRI checkpoint import allows local image tag poisoning
CVSS 9.9 criticalEPSS 0.30%
CVE-2026-4764 Privilege Escalation in Dialogflow CX via Playbook Import
CVSS 9.4 criticalEPSS 0.21%
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
CVSS 9.2 criticalEPSS 0.24%
CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)
CVSS 9.3 criticalEPSS 1.8%
CVE-2026-3136 Google Cloud Build Comment Control Bypass
CVSS 9.8 criticalEPSS 0.37%
CVE-2026-1727 Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
CVSS 9.1 criticalEPSS 0.29%
CVE-2025-12414 Looker account compromise via punycode homograph attack
CVSS 9.2 criticalEPSS 0.37%
CVE-2025-9118 Dataform Path Traversal
CVSS 10.0 criticalEPSS 0.68%
CVE-2025-0982 Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
CVSS 10.0 criticalEPSS 0.26%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)