CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2025-12414

CVE-2025-12414 affects Looker installations using OIDC authentication, due to email address string normalization. Looker-hosted deployments are mitigated; self-hosted instances require upgrading to fixed versions (examples listed: 24.12.100+, 24.18.193+, 25.0.69+, 25.6.57+, 25.8.39+, 25.10.22+, 2...

CVE-2024-8912

An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: Looker Google Cloud core was found to be vulnerable. This issue has already been mitigated and our...