Google Cloud

Remote Code Execution in Google Agent Development Kit (ADK)

Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection

Arbitrary File Read in Google Agent Development Kit (ADK)

GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

Command Injection in Looker

Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME

Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

Google Cloud Internal Integration Platform APIs: Missing Authorization

Dataform Path Traversal

SSRF in Gemini Enterprise Agent Platform App Builder

Missing Authorization in Application Integration QueryEngineTask

Bucket Squatting in Vertex AI Search for Commerce

Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution

Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover

also in 1 other product

Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service

Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Confused Deputy in Application Integration allows Internal File Read

Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover

Cross-Site WebSocket Hijacking in Google Cloud Shell

Zip Slip in Google SecOps SOAR allows for Remote Code Execution

Google Cloud BigQuery: Missing Authorization

Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation

Google Cloud Build Comment Control Bypass via Webhook Suppression