1576 matches found
EUVD-2026-68214
jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...
CVE-2026-5704
creationtimestamp| type| source ---|---|--- 2026-08-26 22:40:09+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mtzfnd3gcu2n 2026-08-26 22:40:12+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mtzfndatp327 2026-08-26 22:40:13+00:00| seen|...
CVE-2026-19485
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
EUVD-2026-66653
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
CVE-2026-12717 Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...
PT-2026-82243
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
CVE-2026-19485: Use of Insufficiently Random Values
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...
CVE-2026-12717: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...
Relative Path Traversal
Overview Affected versions of this package are vulnerable to Relative Path Traversal through the downloadFileName process. An attacker can create or overwrite files outside the intended directory by supplying specially crafted object names containing parent-directory segments in a Google Cloud...
GHSA-F78G-9385-QXQJ Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...
CVE-2026-12710 Missing Authorization in Application Integration QueryEngineTask
A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration versions from 2025-04-28 to 2026-04-04 allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required...
CVE-2026-12710: Missing Authorization
A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration versions from 2025-04-28 to 2026-04-04 allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required...
CVE-2026-15623 Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...
EUVD-2026-60060
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...
CVE-2026-15623 Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...
PT-2026-73215
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...
MAL-2026-14068 Malicious code in depcruise-wrap-stream-in-html (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...
CVE-2017-7932
creationtimestamp| type| source ---|---|--- 2026-08-14 16:00:16+00:00| seen| https://t.me/purpsec/618 2026-08-15 00:00:06+00:00| seen| https://t.me/purpsec/618...
PYSEC-2026-3714
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
Malicious code in consumerweb-creditcollection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1d673b014d7769d23ec9252c38424a3d1e2b400756cafa605f65383d93da348 [email protected] is a hollow package whose main index.js exports an empty object. Its sole runtime effect is pulling in a dependen...