CVEs for Google Cloud
103 matching vulnerabilities, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-12879 Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy
CVSS 5.9 mediumEPSS 0.30%Google Cloud
CVE-2026-53359 KVM: x86: Fix shadow paging use-after-free due to unexpected role
CVSS 8.8 highEPSS 1.4%Google Cloud
CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
CVSS 9.6 criticalEPSS 0.35%Google Cloud
CVE-2026-50195 containerd: CRI checkpoint import allows local image tag poisoning
CVSS 9.9 criticalEPSS 0.30%Google Cloud
CVE-2026-47262 containerd image-triggered runtime DoS via unbounded group parsing
CVSS 5.5 mediumEPSS 0.26%Google Cloud
CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI
CVSS 6.9 mediumEPSS 0.51%Google Cloud
CVE-2026-4764 Privilege Escalation in Dialogflow CX via Playbook Import
CVSS 9.4 criticalEPSS 0.21%Google Cloud
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
CVSS 9.2 criticalEPSS 0.24%Google Cloud
CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)
CVSS 9.3 criticalEPSS 1.8%Google Cloud
CVE-2026-3136 Google Cloud Build Comment Control Bypass
CVSS 9.8 criticalEPSS 0.37%Google Cloud
CVE-2026-2244 Sensitive Data Exposure in Google Cloud Vertex AI Workbench
CVSS 8.4 highEPSS 0.26%Google Cloud
CVE-2026-2473 Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.
CVSS 7.7 highEPSS 0.51%Google Cloud
CVE-2026-2472 Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization
CVSS 8.1 highEPSS 0.61%Google Cloud
CVE-2026-2274 Arbitrary File Read and SSRF in Google AppSheet
CVSS 8.5 highEPSS 0.29%Google Cloud
CVE-2026-1727 Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
CVSS 9.1 criticalEPSS 0.29%Google Cloud
CVE-2025-13427 Authentication Bypass in Dialogflow CX Messenger
CVSS 6.9 mediumEPSS 0.47%Google Cloud
CVE-2025-12952 Privilege Escalation in Dialogflow CX via Webhook Admin Role
CVSS 8.7 highEPSS 0.37%Google Cloud
CVE-2025-13428 RCE in SecOps SOAR server via user-provided Python packages
CVSS 7.2 highEPSS 0.33%Google Cloud
CVE-2025-12742 Remote Code Execution in Looker via Teradata JDBC Driver
CVSS 7.5 highEPSS 0.24%Google Cloud
CVE-2025-12740 Remote Command Execution in Looker via IBM DB2 JDBC drive
CVSS 7.7 highEPSS 0.26%Google Cloud
CVE-2025-12414 Looker account compromise via punycode homograph attack
CVSS 9.2 criticalEPSS 0.37%Google Cloud
CVE-2025-12405 Unauthorized access through stored credentials in Looker Studio
CVSS 7.7 highEPSS 0.27%Google Cloud
CVE-2025-12409 SQL Injection in Looker Studio
CVSS 7.3 highEPSS 0.27%Google Cloud
CVE-2025-12397 SQL Injection in Looker Studio
CVSS 7.6 highEPSS 0.33%Google Cloud
CVE-2025-12155 Command Injection in Looker
CVSS 7.1 highEPSS 1.3%Google Cloud
CVE-2025-11915 HTTP Desynchronisation in Vertex AI for certain third-party models
CVSS 6.9 mediumEPSS 0.32%Google Cloud
CVE-2025-9918 Zip Slip in Google SecOps SOAR allows for Remote Code Execution
CVSS 8.7 highEPSS 0.63%Google Cloud
CVE-2025-9118 Dataform Path Traversal
CVSS 10.0 criticalEPSS 0.68%Google Cloud
CVE-2025-0982 Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
CVSS 10.0 criticalEPSS 0.26%Google Cloud
Not scoredGoogle Cloud
Not scoredGoogle Cloud
Not scoredGoogle Cloud
Not scoredGoogle Cloud
Not scoredGoogle Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)