GC
Vendor security profile
Google Cloud
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs13
Critical9
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS9.0
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
6
7
0
CVE KEV
CVE severity distribution
13toplam CVE
Critical9 (69%)
High4 (31%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
13Unknown
Latest vulnerabilities
8.3
CVE-2026-81375
Confused Deputy in Application Integration allows Internal File Read
GC
Patch status unknownEPSS %0
9.4
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
GC
Patch status unknownEPSS %0
9.4
CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
GC
Patch status unknownEPSS %0
7.7
CVE-2026-19407
GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
GC
Patch status unknownEPSS %1
8.7
CVE-2026-19486
SSRF in Gemini Enterprise Agent Platform App Builder
GC
Patch status unknownEPSS %0
7.7
CVE-2026-13745
Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME
GC
Patch status unknownEPSS %0
10.0
CVE-2026-79696
Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
GC
Patch status unknownEPSS %1
9.4
CVE-2026-19410
Google Cloud Build Comment Control Bypass via Webhook Suppression
GC
Patch status unknownEPSS %0
9.3
CVE-2026-19485
Bucket Squatting in Vertex AI Search for Commerce
GC
Patch status unknownEPSS %0
9.4
CVE-2026-12717
Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
GC
Patch status unknownEPSS %0