Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-12879

Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Cloud Apigee
CVE-2026-2264

Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Cloud Apigee-x
CVE-2025-13292

Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action is required for this.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Cloud Apigee-x
CVE-2025-13426

Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Cloud Apigee