Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30

Export CSV
CVE-2026-2031

Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.

An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Internal Integration Platform Apis
CVE-2026-7428

Insecure default administrative credentials in AlloyDB for PostgreSQL

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Alloydb For Postgresql
CVE-2026-3259

Sensitive Data Disclosure in BigQuery via Materialized View Error Messages

A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Platform allows an authenticated user to potentially disclose sensitive data using a crafted materialized view that triggers a runtime error during the refresh process. This vulnerability was patched on 29 January 2026, and no customer action is needed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Bigquery
CVE-2026-3136

Google Cloud Build Comment Control Bypass

An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer action is needed.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Google Google Cloud
Products
Cloud Build Cloud Build
CVE-2026-2473

Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting). This vulnerability was patched and no customer action is needed.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Vertex Ai Experiments
CVE-2026-2472

Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Vertex Ai Sdk For Python
CVE-2025-9918

Zip Slip in Google SecOps SOAR allows for Remote Code Execution

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution (RCE) via uploading a malicious ZIP archive containing path traversal sequences.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Google Google Cloud
Products
Cloud Platform Secops Soar Server
CVE-2025-11915

HTTP Desynchronisation in Vertex AI for certain third-party models

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Google Google Cloud
Products
Cloud Platform Vertex Ai
CVE-2026-4810

Remote Code Execution in Google Agent Development Kit (ADK)

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This vulnerability was patched in versions 1.28.1 and 2.0.0a2. Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.

CVSS 4.0 · 9.3 Critical EPSS 2.2% KEV · Not listed
Vendors
Google Cloud
Products
Agent Development Kit (adk)
CVE-2024-9858

Insecure user permissions in Google Cloud Migrate to Containers for Windows

There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the action to delete the local user “m2cuser”. We recommend upgrading to 1.2.3 or beyond

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Google Google Cloud
Products
Migrate To Containers Migrate To Containers