Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-79696

Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Agent Development Kit (adk)
CVE-2026-79707

Arbitrary File Read in Google Agent Development Kit (ADK)

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Agent Development Kit (adk)
CVE-2026-18236

Google-ADK Continuation Forgery

A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Agent Development Kit (adk)
CVE-2026-4810

Remote Code Execution in Google Agent Development Kit (ADK)

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This vulnerability was patched in versions 1.28.1 and 2.0.0a2. Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.

CVSS 4.0 · 9.3 Critical EPSS 2.2% KEV · Not listed
Vendors
Google Cloud
Products
Agent Development Kit (adk)