cve-coordination@google.com
organization01
Rollen
Rollen dieser Identität.
02
Referenzen
Weitere Namen und Kennungen dieser Entität.
nvdUS cve-coordination@google.com
03
bewertete Schwachstellen (291)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-107858US | —OT erhöht | — | ||
Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Devel… | ||||
| CVE-2026-111497US | — | Exploit | ||
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to co… | ||||
| CVE-2026-103090US | —OT erhöht | — | ||
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET… | ||||
| CVE-2026-105772US | — | — | ||
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching th… | ||||
| CVE-2026-103091US | —OT erhöht | — | ||
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registrat… | ||||
| CVE-2026-102503US | —OT erhöht | — | ||
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google… | ||||
| CVE-2026-102554US | — | — | ||
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial o… | ||||
| CVE-2026-95702US | — | — | ||
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code executi… | ||||
| CVE-2026-102252US | — | — | ||
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target… | ||||
| CVE-2026-102242US | — | — | ||
Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated a… | ||||
| CVE-2026-87723US | — | — | ||
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing… | ||||
| CVE-2026-96812US | — | — | ||
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local at… | ||||
| CVE-2026-87722US | — | — | ||
Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicate… | ||||
| CVE-2026-87721US | — | — | ||
Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 throug… | ||||
| CVE-2026-87720US | —OT erhöht | — | ||
Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.… | ||||
| CVE-2026-19202US | — | — | ||
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application u… | ||||
| CVE-2026-89418US | — | — | ||
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to… | ||||
| CVE-2026-83530US | medium4.3 | — | ||
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proport… | ||||
| CVE-2026-19201US | high7.5 | — | ||
An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of ser… | ||||
| CVE-2026-75062US | —OT erhöht | — | ||
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remo… | ||||