CVEs for Google Cloud
26 matching vulnerabilities, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-109618 RCE via OOM corruption
CVSS 9.8 criticalEPSS 100.0%Amazon Web ServicesGoogle Cloud15 incidents
CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
CVSS 10.0 criticalEPSS 0.74%Google Cloud
CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression
CVSS 9.4 criticalEPSS 0.20%Google Cloud
CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
CVSS 9.3 criticalEPSS 0.38%Google Cloud
CVE-2026-12710 Missing Authorization in Application Integration QueryEngineTask
CVSS 9.3 criticalEPSS 0.41%Google Cloud
CVE-2026-59310 vCenter directory-traversal vulnerability
CVSS 9.8 criticalKEV added EPSS 2.6%Google Cloud
CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability
CVSS 9.3 criticalEPSS 0.19%Google Cloud
CVE-2026-59309 vCenter authentication-bypass vulnerability
CVSS 9.8 criticalEPSS 0.61%Google Cloud
CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
CVSS 9.6 criticalEPSS 0.35%Google Cloud
CVE-2026-50195 containerd: CRI checkpoint import allows local image tag poisoning
CVSS 9.9 criticalEPSS 0.30%Google Cloud
CVE-2026-4764 Privilege Escalation in Dialogflow CX via Playbook Import
CVSS 9.4 criticalEPSS 0.21%Google Cloud
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
CVSS 9.2 criticalEPSS 0.24%Google Cloud
CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)
CVSS 9.3 criticalEPSS 1.8%Google Cloud
CVE-2026-3136 Google Cloud Build Comment Control Bypass
CVSS 9.8 criticalEPSS 0.37%Google Cloud
CVE-2026-1727 Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
CVSS 9.1 criticalEPSS 0.29%Google Cloud
CVE-2025-12414 Looker account compromise via punycode homograph attack
CVSS 9.2 criticalEPSS 0.37%Google Cloud
CVE-2025-9118 Dataform Path Traversal
CVSS 10.0 criticalEPSS 0.68%Google Cloud
CVE-2025-0982 Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
CVSS 10.0 criticalEPSS 0.26%Google Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)