CVEs for Google Cloud
103 matching vulnerabilities, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-109619 RCE via stale global state
CVSS 8.1 highEPSS 100.0%Amazon Web ServicesGoogle Cloud14 incidents
CVE-2026-109618 RCE via OOM corruption
CVSS 9.8 criticalEPSS 100.0%Amazon Web ServicesGoogle Cloud15 incidents
CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
Not scoredEPSS 0.30%Amazon Web ServicesGoogle Cloud2 incidents
CVE-2026-85267 Cross-Site WebSocket Hijacking in Google Cloud Shell
CVSS 8.7 highEPSS 0.21%Google Cloud
CVE-2026-81375 Confused Deputy in Application Integration allows Internal File Read
CVSS 8.3 highEPSS 0.32%Google Cloud
CVE-2026-73553 Envoy: RBAC Authorization Bypass via Path Parameters
CVSS 7.5 highEPSS 0.51%Google Cloud
CVE-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
CVSS 7.4 highEPSS 0.62%Google Cloud
CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects
CVSS 7.5 highEPSS 0.87%Google Cloud
CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
CVSS 7.5 highEPSS 0.55%Google Cloud
CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling
CVSS 7.5 highEPSS 0.49%Google Cloud
CVE-2026-50572 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
CVSS 5.9 mediumEPSS 0.68%Google Cloud
CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder
CVSS 8.7 highEPSS 0.42%Google Cloud
CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
CVSS 10.0 criticalEPSS 0.74%Google Cloud
CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)
CVSS 8.7 highEPSS 0.67%Google Cloud
CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression
CVSS 9.4 criticalEPSS 0.20%Google Cloud
CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
CVSS 9.3 criticalEPSS 0.38%Google Cloud
CVE-2026-12710 Missing Authorization in Application Integration QueryEngineTask
CVSS 9.3 criticalEPSS 0.41%Google Cloud
CVE-2026-59310 vCenter directory-traversal vulnerability
CVSS 9.8 criticalKEV added EPSS 2.6%Google Cloud
CVSS 5.3 mediumEPSS 0.10%Google Cloud
CVSS 4.5 mediumEPSS 0.10%Google Cloud
CVSS 4.3 mediumEPSS 0.09%Google Cloud
CVSS 5.6 mediumEPSS 0.07%Google Cloud
CVSS 7.2 highEPSS 0.13%Google Cloud
CVSS 7.2 highEPSS 0.15%Google Cloud
CVSS 5.3 mediumEPSS 0.12%Google Cloud
CVSS 4.5 mediumEPSS 0.10%Google Cloud
CVSS 5.3 mediumEPSS 0.13%Google Cloud
CVE-2026-6726 An information leakage vulnerability in the TCG TPM 2.0 reference code.
CVSS 7.9 highEPSS 0.19%Google Cloud
CVE-2026-41709 ESX insufficient logging vulnerability
CVSS 2.7 lowEPSS 0.30%Google Cloud
CVE-2026-41703 Out-of-bounds read vulnerability
CVSS 7.6 highEPSS 0.43%Google Cloud
CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability
CVSS 9.3 criticalEPSS 0.19%Google Cloud
CVE-2026-59309 vCenter authentication-bypass vulnerability
CVSS 9.8 criticalEPSS 0.61%Google Cloud
CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
CVSS 8.7 highEPSS 0.45%Google Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)