Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,736All CVEsplus 19,141 rejected
- 659Last 24 hours3,036 in the last 7 days
- 17,189Last 30 days1,611 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 19 | 19 | 2 | 0 | 0 | 40 | 60 |
| 2025 | 2 | 15 | 3 | 0 | 0 | 20 | 20 |
| Title | ||
|---|---|---|
| CVE-2026-93327 | Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code ExecutionGoogle Cloud · Application Integration | Critical9.4 |
| CVE-2026-85268 | Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle IDGoogle Cloud · Identity Platform and Firebase Authentication | High8.7 |
| CVE-2026-85299 | Missing Authorization in Compute Engine allows Cross-Project Disk ExfiltrationGoogle Cloud · Compute Engine | High8.3 |
| CVE-2026-85297 | Bucket Squatting in Cloud Run MCP leads to Service Account TakeoverGoogle Cloud · Cloud Run MCP | High7.7 |
| CVE-2026-93328 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and WriteGoogle Cloud · MCP Toolbox for Databases (googleapis/mcp-toolbox) | Critical9.3 |
| CVE-2026-85267 | Cross-Site WebSocket Hijacking in Google Cloud ShellGoogle Cloud · Cloud Shell | High8.7 |
| CVE-2026-85298 | Improper Authorization in Google Cloud Application Integration Leads to Privilege EscalationGoogle Cloud · Application Integration | High7.3 |
| CVE-2026-81375 | Confused Deputy in Application Integration allows Internal File ReadGoogle Cloud · Application Integration | High8.3 |
| CVE-2026-81867 | Deserialization of Untrusted Data in Application Integration allows Remote Code ExecutionGoogle Cloud · Application Integration | Critical9.4 |
| CVE-2026-19759 | Incorrect Authorization in Application Integration allows Internal Stubby RPC ExecutionGoogle Cloud · Application Integration | Critical9.4 |
| CVE-2026-19407 | GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDKGoogle Cloud · Gemini Enterprise Agent Platform SDK for Python | High7.7 |
| CVE-2026-19486 | SSRF in Gemini Enterprise Agent Platform App BuilderGoogle Cloud · Gemini Enterprise Agent Platform App Builder | High8.7 |
| CVE-2026-13745 | Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOMEGoogle Cloud · Gemini CLI | High7.7 |
| CVE-2026-79696 | Remote Code Execution in Google ADK for Python via Incomplete Standard Library DenylistGoogle Cloud · Agent Development Kit (ADK) for Python | Critical10.0 |
| CVE-2026-4644 | Improper Authorization in Google Cloud Integration Connectors Leads to Project TakeoverGoogle Cloud · Integration Connectors | High8.5 |
| CVE-2026-79707 | Arbitrary File Read in Google Agent Development Kit (ADK)Google Cloud · Agent Development Kit (ADK) | High8.7 |
| CVE-2026-19410 | Google Cloud Build Comment Control Bypass via Webhook SuppressionGoogle Cloud · Google Cloud Build | Critical9.4 |
| CVE-2026-19485 | Bucket Squatting in Vertex AI Search for CommerceGoogle Cloud · Vertex AI Search for Commerce | Critical9.3 |
| CVE-2026-12717 | Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String InjectionGoogle Cloud · BigQuery Data Transfer Service | Critical9.4 |
| CVE-2026-12710 | Missing Authorization in Application Integration QueryEngineTaskGoogle Cloud · Application Integration | Critical9.3 |
| CVE-2026-15623 | Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query ServiceGoogle Cloud · Google SecOps (Chronicle SOAR) | Critical9.4 |
| CVE-2026-15587 | Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication HeaderGoogle Cloud · Google SecOps (Chronicle SOAR) | Critical9.4 |
| CVE-2026-15810 | Cross-Site Scripting (XSS) in Looker allows Admin Account TakeoverGoogle Cloud · Looker | High8.7 |
| CVE-2026-12715 | Missing Authorization in Firebase Studio allows Cross-Tenant Source Code TheftGoogle Cloud · Firebase Studio | High8.5 |
| CVE-2026-14934 | Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab EnterpriseGoogle Cloud · BigQuery | Critical9.4 |
| CVE-2026-12879 | Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused DeputyGoogle Cloud · Apigee | Medium5.9 |
| CVE-2026-12537 | Unauthenticated Remote Code Execution in Gemini CLI CI/CD WorkflowsGoogle Cloud · Gemini CLI | Critical10.0 |
| CVE-2026-8934 | Cross-Project Information Leakage in Google App Engine UIGoogle Cloud · Cloud Console UIs | Medium6.9 |
| CVE-2026-4764 | Privilege Escalation in Dialogflow CX via Playbook ImportGoogle Cloud · Dialogflow CX | Critical9.4 |
| CVE-2026-2264 | Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.Google Cloud · Apigee-X | Critical9.2 |
| CVE-2026-2031 | Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.Google Cloud · Internal Integration Platform APIs | Critical10.0 |
| CVE-2026-7428 | Insecure default administrative credentials in AlloyDB for PostgreSQLGoogle Cloud · AlloyDB for PostgreSQL | Critical9.2 |
| CVE-2026-3259 | Sensitive Data Disclosure in BigQuery via Materialized View Error MessagesGoogle Cloud · BigQuery | High7.1 |
| CVE-2026-4810 | Remote Code Execution in Google Agent Development Kit (ADK)Google Cloud · Agent Development Kit (ADK) | Critical9.3 |
| CVE-2026-3136 | Google Cloud Build Comment Control BypassGoogle Cloud · Cloud Build | High8.6 |
| CVE-2026-2244 | Sensitive Data Exposure in Google Cloud Vertex AI WorkbenchGoogle Cloud · Vertex AI Workbench | High8.4 |
| CVE-2026-2473 | Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.Google Cloud · Vertex AI Experiments | High7.7 |
| CVE-2026-2472 | Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK VisualizationGoogle Cloud · Vertex AI SDK for Python | High8.6 |
| CVE-2026-2274 | Arbitrary File Read and SSRF in Google AppSheetAppSheet · AppSheet Web (Main Server) | High8.5 |
| CVE-2026-1727 | Information Disclosure via Bucket Squatting in Google Cloud Agentspace.Google Cloud · Gemini Enterprise (formerly Agentspace) | Critical9.1 |
| CVE-2025-13427 | Authentication Bypass in Dialogflow CX MessengerGoogle Cloud · Dialogflow CX Messenger | Medium6.9 |
| CVE-2025-12952 | Privilege Escalation in Dialogflow CX via Webhook Admin RoleGoogle Cloud · Dialogflow CX | High8.7 |
| CVE-2025-9571 | Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact UploadGoogle Cloud · Cloud Data Fusion | High8.7 |
| CVE-2025-13428 | RCE in SecOps SOAR server via user-provided Python packagesGoogle Cloud · Google Cloud SecOps SOAR | High8.6 |
| CVE-2025-13292 | Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.Google Cloud · Apigee-X | High7.6 |
| CVE-2025-13426 | Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code ExecutionGoogle Cloud · Apigee hybrid Javacallout policy | High8.7 |
| CVE-2025-12742 | Remote Code Execution in Looker via Teradata JDBC DriverGoogle Cloud · Looker | High7.5 |
| CVE-2025-12741 | Arbitrary File Write in Denodo dialect of Looker allows Remote Code ExecutionGoogle Cloud · Looker | High7.7 |
| CVE-2025-12740 | Remote Command Execution in Looker via IBM DB2 JDBC driveGoogle Cloud · Looker | High7.7 |
| CVE-2025-12739 | Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account CompromiseGoogle Cloud · Looker | High7.3 |