Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-12537

Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Google Google Cloud
Products
Gemini-cli Run-gemini-cli Gemini Cli and 1 more
CVE-2026-1727

Information Disclosure via Bucket Squatting in Google Cloud Agentspace.

The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to engage in "bucket squatting" by establishing these buckets before a victim's initial use. All versions after December 12th, 2025 have been updated to protect from this vulnerability. No user action is required for this.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Gemini
CVE-2025-5009

Information Disclosure in Gemini iOS App

In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Ios Gemini