Looker Login Panel - Detect

Looker login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Looker login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Looker Login Panel - Detect', 'description': 'Looker logi...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-15810

CVE-2026-15810 is a cross-site scripting (XSS) vulnerability in Google Cloud Looker prior to versions 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7. The issue affects both Looker-hosted and self-hosted deployments and enables an attacker to execute arbitrary JavaScr...

CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

EUVD-2026-48557

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

PT-2026-64276

Name of the Vulnerable Software and Affected Versions Google Cloud Looker versions prior to 25.6.103 Google Cloud Looker versions prior to 25.12.65 Google Cloud Looker versions prior to 25.18.68 Google Cloud Looker versions prior to 26.0.66 Google Cloud Looker versions prior to 26.2.47 Google Clo...

CVE-2026-15810: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-55865 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +7 more potentially affected by CVE-2026-55865 via python-liquid (>=1.9.4, <=2.2.0)

python-liquid PYPI version =1.9.4, =1.8.0a3, =0.26.6rc0, =0.8.0, =0.1.1, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =1.8.0, =1.28.4 Source cves: CVE-2026-55865 Source advisory: MEND:CVE-2026-55865...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-55865 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-55865 Source advisory: OSV:GHSA-VQ2F-VCC9-J8MV...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-45017 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-45017 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-45017 Source advisory: OSV:GHSA-8P4X-WR7X-3788...

CVE-2025-12743

The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT...

CVE-2025-12414

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted. Self-hosted instances must be upgrad...

CVE-2025-12739

An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and Self-hosted were found to be vulnerable. This...

CVE-2025-12742

A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required...

CVE-2025-12472

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

CVE-2025-12741

A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious command. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user...