68 matches found
CVE-2026-2472-Vertex-AI-SDK-Google-Cloud
Cross-Site Scripting XSS almacenado sin autenticaciรณn en genai/evalsvisualization.py del SDK de Google Cloud Vertex AI google-cloud-aiplatform versiones desde 1.98.0 hasta sin incluir 1.131.0 - github.com/googleapis/python-aiplatform Autor: Joshua Provoste Investigador y desarrollador de N-day...
CVE-2026-2472-Vertex-AI-SDK-Google-Cloud
๐จ CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - ็ฎๅๆฆๅฟต้ช่ฏๅทฅๅ ท ๐ ๅ ณไบๆญคๅบ็จ็จๅบ ๆญคๅทฅๅ ท้ๅฏนๅฎๅ จๆผๆด CVE-2026-2472 ๆไพไบๆๆฏๆงๆฆๅฟต้ช่ฏ PoCใ่ฏฅๆผๆดๅฝฑๅ Google Cloud Platform ็ Vertex AI Python SDKใๅฎๆถๅ SDK ไธญไธ Jupyter ๅ Colab ็ฌ่ฎฐๆฌไธ่ตทไฝฟ็จ็้จๅๆๅญๅจ็ๆช็ป้ช่ฏ็ๅญๅจๅ่ทจ็ซ่ๆฌ XSS ๆผๆดใ ่ฏฅ่ฝฏไปถๅธฎๅฉๆจไบ่งฃๆญคๆผๆดๆฏๅฆไฝ่ขซ่งฆๅ็ใๅฎๅฏๅจ Windows ไธ่ฟ่ก๏ผๆ ้็ผ็จ็ฅ่ฏใๆจๅฏไปฅๅจ่ชๅทฑ็็ณป็ปไธๅฎๅ จๅฐ่ฟ่กๆต่ฏ๏ผไปฅไบ่งฃ็ธๅ ณ้ฃ้ฉใ ๐ฅ ็ณป็ป่ฆๆฑ...
sentinel-mcp
SentinelMCP โ AI ๆญ่ผใตใคใใผ้ฒๅพกใทในใใ Google Cloud Hackathon ๆๅบไฝๅ โ ่ชๅพ็ใช่ ๅจๆคๅบใจๅฏพๅฆใ Google Cloud Agent Builder Vertex AI Agent ใ่ชฟๆดใใGemini 2.0 FlashใModel Context Protocol MCPใDynatrace ๅฏ่ฆณๆธฌๆงใๆดป็จใ ๅ้ก็น ใปใญใฅใชใใฃใใผใ ใฏใไธ่ฌ็ใชใคใณใทใใณใใซๅฏพใใฆ 30 ๅใฎ MTTD ใจ 4 ๆ้ใฎ MTTR...
CVE-2026-75871
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...
CVE-2026-19889
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an...
PT-2026-82510
Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.9.0 through 19.0.12 GitLab AI Gateway versions 19.1 through 19.1.7 GitLab AI Gateway versions 19.2 through 19.2.2 Description An issue in the AI Gateway component allows an authenticated user with Duo Agent Platfo...
PT-2026-82552
Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.10 through 19.0.12 GitLab AI Gateway versions 19.1 through 19.1.7 GitLab AI Gateway versions 19.2 through 19.2.2 Description An authenticated user with Duo Agent Platform access can redirect outbound model request...
CVE-2026-19485
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
CVE-2026-19485
CVE-2026-19485 is a Predictable Resource Name (bucket squatting) vulnerability in BigQuery Import Staging within Google Cloud Vertex AI Search for Commerce on Google Cloud Platform, affecting versions prior to 2026-04-27 . An attacker knowing the victim's project number could derive the predictab...
EUVD-2026-66653
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
PT-2026-82243
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
CVE-2026-19485: Use of Insufficiently Random Values
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
PYSEC-2026-2499 Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
Stored Cross-Site Scripting XSS in the genai/evalsvisualization component of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment...
Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
Stored Cross-Site Scripting XSS in the genai/evalsvisualization component of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment...
Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up tobut not including 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably...
PYSEC-2026-2500 Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to but not including 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictabl...
PT-2026-59162
Stored Cross-Site Scripting XSS in the genai/ evals visualization component of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environme...
