Skip to content
OpenAdvisories

Vendor

Google Cloud

63 known vulnerabilities.

Products

Looker 10 Application Integration 7 Looker Studio 3 Google SecOps (Chronicle SOAR) 2 Apigee-X 2 Gemini CLI 2 Dialogflow CX 2 BigQuery 2 Dataform 2 Agent Development Kit (ADK) 2 Google SecOps SOAR 1 Apigee hybrid Javacallout policy 1 MCP Toolbox for Databases (googleapis/mcp-toolbox) 1 Firebase Studio 1 Vertex AI: Partner Models for MaaS 1 Vertex AI: Open Models for MaaS 1 Vertex AI: Self-Deployed Models 1 BigQuery Data Transfer Service 1 Gemini Enterprise Agent Platform App Builder 1 Internal Integration Platform APIs 1 Google Cloud Build 1 Cloud Shell 1 Vertex AI SDK for Python 1 Compute Engine 1 Dialogflow CX Messenger 1 run-gemini-cli GitHub Action 1 Vertex AI Search for Commerce 1 Identity Platform and Firebase Authentication 1 Migrate to Containers 1 Classic Application Load Balancer 1 Apigee 1 Integration Connectors 1 Colab Enterprise 1 Cloud Data Fusion 1 Cloud Console UIs 1 AlloyDB for PostgreSQL 1 Google Cloud SecOps SOAR 1 Agent Development Kit (ADK) for Python 1 Gemini Enterprise Agent Platform SDK for Python 1 Cloud Build 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-12879

    Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy

    An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 on the Api…

    Google Cloud Apigee
  • Medium 6.9
    CVE-2026-8934

    Cross-Project Information Leakage in Google App Engine UI

    A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted re…

    Google Cloud Cloud Console UIs
  • Medium 6.9
    CVE-2025-13427

    Authentication Bypass in Dialogflow CX Messenger

    An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining access to the agents' knowledge and the ability to trigger their intents, by manipulating initializat…

    Google Cloud Dialogflow CX Messenger
  • Medium 6.0
    CVE-2025-12743

    SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database

    The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enab…

    Google Cloud Looker
  • Medium 6.9
    CVE-2025-11915

    HTTP Desynchronisation in Vertex AI for certain third-party models

    Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

    Google Cloud Vertex AI: Partner Models for MaaS Vertex AI: Self-Deployed Models Vertex AI: Open Models for MaaS
  • Medium 5.9
    CVE-2024-9858

    Insecure user permissions in Google Cloud Migrate to Containers for Windows

    There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" command…

    Google Cloud Migrate to Containers
  • Medium 6.5
    CVE-2024-5166

    Insecure Direct Object Reference In Looker

    An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model.

    Google Cloud Looker