PatchTheCVECVEs published by Google Inc.
CVEs published by Google Inc. (CVE Numbering Authority). 11 tracked.
- CVE-2026-18236 CRITICAL 9.3 A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations
- CVE-2026-16481 HIGH 7.5 UPGRADE A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-
- CVE-2026-111497 CRITICAL 9.2 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through
- CVE-2026-14537 CRITICAL 9.8 DOWNGRADE Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0
- CVE-2026-14539 HIGH 7.5 UPGRADE An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox ve
- CVE-2026-14541 HIGH 7.5 DOWNGRADE An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of
- CVE-2026-14538 HIGH 7.7 UPGRADE An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool componen
- CVE-2026-14540 MEDIUM 6.1 UPGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Go
- CVE-2026-10032 MEDIUM 6.1 UPGRADE The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without valida
- CVE-2026-107858 HIGH 7.2 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (
- CVE-2026-103090 HIGH 8.8 Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in t