Google Cloud vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 202522
3. 202639

Newest CVEs

• CVE-2026-93327

  Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution

  Google Cloud · Application Integration

  Critical9.4
• CVE-2026-85268

  Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID

  Google Cloud · Identity Platform and Firebase Authentication

  High8.7
• CVE-2026-85299

  Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration

  Google Cloud · Compute Engine

  High8.3
• CVE-2026-85297

  Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

  Google Cloud · Cloud Run MCP

  High7.7
• CVE-2026-93328

  Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

  Google Cloud · MCP Toolbox for Databases (googleapis/mcp-toolbox)

  Critical9.3
• CVE-2026-85267

  Cross-Site WebSocket Hijacking in Google Cloud Shell

  Google Cloud · Cloud Shell

  High8.7
• CVE-2026-85298

  Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation

  Google Cloud · Application Integration

  High7.3
• CVE-2026-81375

  Confused Deputy in Application Integration allows Internal File Read

  Google Cloud · Application Integration

  High8.3
• CVE-2026-81867

  Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

  Google Cloud · Application Integration

  Critical9.4
• CVE-2026-19759

  Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution

  Google Cloud · Application Integration

  Critical9.4