GC
Vendor
Google Cloud
35
CVEs
0
On KEV
5
New 30D
Products
AI9.4
Application Integration
Google Cloud
5 CVEs0 on KEV1 new
MT9.3
MCP Toolbox for Databases (googleapis/mcp-toolbox)
Google Cloud
1 CVEs0 on KEV1 new
CR7.7
Cloud Run MCP
Google Cloud
1 CVEs0 on KEV1 new
CS8.7
Cloud Shell
Google Cloud
1 CVEs0 on KEV1 new
CE8.3
Compute Engine
Google Cloud
1 CVEs0 on KEV1 new
AD9.3
Agent Development Kit (ADK)
Google Cloud
2 CVEs0 on KEV0 new
BI9.4
BigQuery
Google Cloud
2 CVEs0 on KEV0 new
GC7.8
Gemini CLI
Google Cloud
2 CVEs0 on KEV0 new
GS9.4
Google SecOps (Chronicle SOAR)
Google Cloud
2 CVEs0 on KEV0 new
AD10.0
Agent Development Kit (ADK) for Python
Google Cloud
1 CVEs0 on KEV0 new
AF9.2
AlloyDB for PostgreSQL
Google Cloud
1 CVEs0 on KEV0 new
AP5.9
Apigee
Google Cloud
1 CVEs0 on KEV0 new
AP9.2
Apigee-X
Google Cloud
1 CVEs0 on KEV0 new
BD9.4
BigQuery Data Transfer Service
Google Cloud
1 CVEs0 on KEV0 new
CC6.9
Cloud Console UIs
Google Cloud
1 CVEs0 on KEV0 new
CE9.4
Colab Enterprise
Google Cloud
1 CVEs0 on KEV0 new
DA9.4
Dataform
Google Cloud
1 CVEs0 on KEV0 new
DC9.4
Dialogflow CX
Google Cloud
1 CVEs0 on KEV0 new
FS8.5
Firebase Studio
Google Cloud
1 CVEs0 on KEV0 new
GE8.7
Gemini Enterprise Agent Platform App Builder
Google Cloud
1 CVEs0 on KEV0 new
GE7.7
Gemini Enterprise Agent Platform SDK for Python
Google Cloud
1 CVEs0 on KEV0 new
GC9.4
Google Cloud Build
Google Cloud
1 CVEs0 on KEV0 new
IC8.5
Integration Connectors
Google Cloud
1 CVEs0 on KEV0 new
II10.0
Internal Integration Platform APIs
Google Cloud
1 CVEs0 on KEV0 new
LO8.7
Looker
Google Cloud
1 CVEs0 on KEV0 new
RG7.8
run-gemini-cli GitHub Action
Google Cloud
1 CVEs0 on KEV0 new
VA9.3
Vertex AI Search for Commerce
Google Cloud
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85299 New | CE Compute Engine Google Cloud | 8.3 | Oct 27 | Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration |
| CVE-2026-85297 New | CR Cloud Run MCP Google Cloud | 7.7 | Oct 26 | Bucket Squatting in Cloud Run MCP leads to Service Account Takeover |
| CVE-2026-93328 New | MT MCP Toolbox for Databases (googleapis/mcp-toolbox) Google Cloud | 9.3 | Oct 26 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write |
| CVE-2026-85267 | CS Cloud Shell Google Cloud | 8.7 | Oct 20 | Cross-Site WebSocket Hijacking in Google Cloud Shell |
| CVE-2026-85298 | AI Application Integration Google Cloud | 7.3 | Oct 14 | Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation |
| CVE-2026-81375 | AI Application Integration Google Cloud | 8.3 | Sep 28 | Confused Deputy in Application Integration allows Internal File Read |
| CVE-2026-81867 | AI Application Integration Google Cloud | 9.4 | Sep 28 | Deserialization of Untrusted Data in Application Integration allows Remote Code Execution |
| CVE-2026-19759 | AI Application Integration Google Cloud | 9.4 | Sep 28 | Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution |
| CVE-2026-19407 | GE Gemini Enterprise Agent Platform SDK for Python Google Cloud | 7.7 | Sep 15 | GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK |
| CVE-2026-19486 | GE Gemini Enterprise Agent Platform App Builder Google Cloud | 8.7 | Sep 11 | SSRF in Gemini Enterprise Agent Platform App Builder |
| CVE-2026-13745 | GC Gemini CLI Google Cloud | 7.7 | Sep 10 | Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME |
| CVE-2026-79696 | AD Agent Development Kit (ADK) for Python Google Cloud | 10.0 | Sep 9 | Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist |
| CVE-2026-4644 | IC Integration Connectors Google Cloud | 8.5 | Sep 4 | Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover |
| CVE-2026-79707 | AD Agent Development Kit (ADK) Google Cloud | 8.7 | Sep 4 | Arbitrary File Read in Google Agent Development Kit (ADK) |
| CVE-2026-19410 | GC Google Cloud Build Google Cloud | 9.4 | Aug 31 | Google Cloud Build Comment Control Bypass via Webhook Suppression |
| CVE-2026-19485 | VA Vertex AI Search for Commerce Google Cloud | 9.3 | Aug 26 | Bucket Squatting in Vertex AI Search for Commerce |
| CVE-2026-12717 | BD BigQuery Data Transfer Service Google Cloud | 9.4 | Aug 26 | Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection |
| CVE-2026-12710 | AI Application Integration Google Cloud | 9.3 | Aug 22 | Missing Authorization in Application Integration QueryEngineTask |
| CVE-2026-15623 | GS Google SecOps (Chronicle SOAR) Google Cloud | 9.4 | Aug 17 | Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service |
| CVE-2026-15587 | GS Google SecOps (Chronicle SOAR) Google Cloud | 9.4 | Aug 5 | Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header |
| CVE-2026-15810 | LO Looker Google Cloud | 8.7 | Jul 24 | Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover |
| CVE-2026-12715 | FS Firebase Studio Google Cloud | 8.5 | Jul 17 | Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft |
| CVE-2026-14934 | CE Colab Enterprise Google Cloud | 9.4 | Jul 13 | Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise |
| CVE-2026-12879 | AP Apigee Google Cloud | 5.9 | Jul 9 | Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy |
| CVE-2026-12537 | GC Gemini CLI Google Cloud | 7.8 | Jun 24 | Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows |
| CVE-2026-8934 | CC Cloud Console UIs Google Cloud | 6.9 | Jun 22 | Cross-Project Information Leakage in Google App Engine UI |
| CVE-2026-4764 | DC Dialogflow CX Google Cloud | 9.4 | Jun 11 | Privilege Escalation in Dialogflow CX via Playbook Import |
| CVE-2026-2264 | AP Apigee-X Google Cloud | 9.2 | May 26 | Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy. |
| CVE-2026-2031 | II Internal Integration Platform APIs Google Cloud | 10.0 | May 15 | Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution. |
| CVE-2026-7428 | AF AlloyDB for PostgreSQL Google Cloud | 9.2 | May 12 | Insecure default administrative credentials in AlloyDB for PostgreSQL |
| CVE-2026-3259 | BI BigQuery Google Cloud | 7.1 | Apr 23 | Sensitive Data Disclosure in BigQuery via Materialized View Error Messages |
| CVE-2026-4810 | AD Agent Development Kit (ADK) Google Cloud | 9.3 | Apr 13 | Remote Code Execution in Google Agent Development Kit (ADK) |