Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-19485

Bucket Squatting in Vertex AI Search for Commerce

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names. This vulnerability was patched and no customer action is needed.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Vertex Ai Search For Commerce
CVE-2026-2244

Sensitive Data Exposure in Google Cloud Vertex AI Workbench

A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script. All instances after January 30th, 2026 have been patched to protect from this vulnerability. No user action is required for this.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Vertex Ai
CVE-2026-2473

Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting). This vulnerability was patched and no customer action is needed.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Vertex Ai Experiments
CVE-2026-2472

Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Vertex Ai Sdk For Python
CVE-2025-11915

HTTP Desynchronisation in Vertex AI for certain third-party models

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Google Google Cloud
Products
Cloud Platform Vertex Ai