Google Cloud CVEs
103 vulnerabilities mapped to Google Cloud’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-12715 Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft
CVSS 8.5 highEPSS 0.35%
CVE-2026-12879 Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy
CVSS 5.9 mediumEPSS 0.30%
CVE-2026-53359 KVM: x86: Fix shadow paging use-after-free due to unexpected role
CVSS 8.8 highEPSS 1.4%
CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
CVSS 9.6 criticalEPSS 0.35%
CVE-2026-50195 containerd: CRI checkpoint import allows local image tag poisoning
CVSS 9.9 criticalEPSS 0.30%
CVE-2026-47262 containerd image-triggered runtime DoS via unbounded group parsing
CVSS 5.5 mediumEPSS 0.26%
CVE-2026-12537 Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
CVSS 7.8 highEPSS 0.21%
CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI
CVSS 6.9 mediumEPSS 0.51%
CVE-2026-4764 Privilege Escalation in Dialogflow CX via Playbook Import
CVSS 9.4 criticalEPSS 0.21%
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
CVSS 9.2 criticalEPSS 0.24%
CVE-2026-3259 Sensitive Data Disclosure in BigQuery via Materialized View Error Messages
CVSS 7.1 highEPSS 0.23%
CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)
CVSS 9.3 criticalEPSS 1.8%
CVE-2026-3136 Google Cloud Build Comment Control Bypass
CVSS 9.8 criticalEPSS 0.37%
CVE-2026-2244 Sensitive Data Exposure in Google Cloud Vertex AI Workbench
CVSS 8.4 highEPSS 0.26%
CVE-2026-2473 Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.
CVSS 7.7 highEPSS 0.51%
CVE-2026-2472 Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization
CVSS 8.1 highEPSS 0.61%
CVE-2026-2274 Arbitrary File Read and SSRF in Google AppSheet
CVSS 8.5 highEPSS 0.29%
CVE-2026-1727 Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
CVSS 9.1 criticalEPSS 0.29%
CVE-2025-13427 Authentication Bypass in Dialogflow CX Messenger
CVSS 6.9 mediumEPSS 0.47%
CVE-2025-12952 Privilege Escalation in Dialogflow CX via Webhook Admin Role
CVSS 8.7 highEPSS 0.37%
CVE-2025-9571 Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload
CVSS 8.7 highEPSS 0.44%
CVE-2025-13428 RCE in SecOps SOAR server via user-provided Python packages
CVSS 7.2 highEPSS 0.33%
CVE-2025-12742 Remote Code Execution in Looker via Teradata JDBC Driver
CVSS 7.5 highEPSS 0.24%
CVE-2025-12741 Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution
CVSS 7.7 highEPSS 0.26%
CVE-2025-12740 Remote Command Execution in Looker via IBM DB2 JDBC drive
CVSS 7.7 highEPSS 0.26%
CVE-2025-12414 Looker account compromise via punycode homograph attack
CVSS 9.2 criticalEPSS 0.37%
CVE-2025-12472 Remote Code Execution in Looker due to Improperly Validated Directory Deletion
CVSS 7.1 highEPSS 0.27%
CVE-2025-12405 Unauthorized access through stored credentials in Looker Studio
CVSS 7.7 highEPSS 0.27%
CVE-2025-12409 SQL Injection in Looker Studio
CVSS 7.3 highEPSS 0.27%
CVE-2025-12397 SQL Injection in Looker Studio
CVSS 7.6 highEPSS 0.33%
CVE-2025-12155 Command Injection in Looker
CVSS 7.1 highEPSS 1.3%
CVE-2025-11915 HTTP Desynchronisation in Vertex AI for certain third-party models
CVSS 6.9 mediumEPSS 0.32%
CVE-2025-9918 Zip Slip in Google SecOps SOAR allows for Remote Code Execution
CVSS 8.7 highEPSS 0.63%
CVE-2025-9118 Dataform Path Traversal
CVSS 10.0 criticalEPSS 0.68%
CVE-2025-0982 Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
CVSS 10.0 criticalEPSS 0.26%
Not scored
Not scored
Not scored
Not scored
Not scored
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)