# Google Cloud Platform vulnerabilities Source: https://junglewise.ai/threats/technologies/google-cloud-platform Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/google-cloud-platform.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 43 vulnerabilities in Google Cloud Platform: 2 in the last 7 days and 22 in the last 90 days, 4 of them critical and 3 exploited in the wild. The most recent, CVE-2024-36350, was published on 10 November 2026. 10 vulnerabilities in the last four weeks, up 100% on the four before (5). 2 critical against 0, 2 exploited in the wild against 0. ## Counts - Last 7 days: 2 - Last 30 days: 11 - Last 90 days: 22 - All time: 43 (4 critical, 3 exploited in the wild) ## About Google Cloud Platform Google Cloud Platform is a cloud computing service providing infrastructure, compute, storage, and managed services. ## Latest Google Cloud Platform vulnerabilities - [CVE-2024-36350: AMD EPYC 5th generation processor data cache information leak](https://junglewise.ai/threats/cve-2024-36350-gcp-2026-081) (high, published 10 Nov 2026) - [CVE-2026-31836: Istio authentication bypass or access control vulnerability](https://junglewise.ai/threats/cve-2026-31836-gcp-2026-080) (high, published 9 Nov 2026) - [CVE-2026-65107: Slurm multiple vulnerabilities in Cluster Toolkit](https://junglewise.ai/threats/cve-2026-65107-slurm-sbcast-shared-library-validation-bypass) (high, CVSS 6.3, published 3 Nov 2026) - [CVE-2026-93327: Google Application Integration deserialization of untrusted data in SubWorkflow](https://junglewise.ai/threats/cve-2026-93327-gcp-2026-074) (high, published 30 Oct 2026) - [CVE-2026-85299: Google Compute Engine incorrect authorization in disk access](https://junglewise.ai/threats/cve-2026-85299-gcp-2026-073) (high, published 27 Oct 2026) - [CVE-2026-111497: Google Brotli buffer overflow in decoder](https://junglewise.ai/threats/cve-2026-111497-a-buffer-overflow-vulnerability-in-the-brotli-decoder-c-dec) (critical, exploited in the wild, CVSS 4, published 22 Oct 2026) - [CVE-2026-109618: PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070) (critical, exploited in the wild, published 21 Oct 2026) - [CVE-2026-111943: Go crypto/x509 untrusted intermediate certificate validation](https://junglewise.ai/threats/cve-2026-111943-on-most-platforms-go-uses-the-given-system-root-certificates) (high, published 21 Oct 2026) - [Istio and Envoy Proxy security vulnerabilities](https://junglewise.ai/threats/gcp-2026-069-6d8e440c) (info, published 19 Oct 2026) - [CVE-2026-98432: Linux kernel ipv4 use-after-free in TCP option handling](https://junglewise.ai/threats/cve-2026-98432-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (high, published 15 Oct 2026) - [CVE-2026-85298: Google Cloud Application Integration privilege escalation in AuthConfig](https://junglewise.ai/threats/cve-2026-85298-gcp-2026-068) (high, published 14 Oct 2026) - [Envoy Proxy denial-of-service in HTTP filter with prefix_rewrite](https://junglewise.ai/threats/gcp-2026-067-0c826055) (info, published 12 Oct 2026) - [CVE-2026-81867: Google Cloud Application Integration JavaScript Task deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-81867-gcp-2026-065) (high, published 28 Sep 2026) - [CVE-2026-81375: Google Cloud Application Integration Confused Deputy in Email Task](https://junglewise.ai/threats/cve-2026-81375-gcp-2026-066) (high, published 28 Sep 2026) - [CVE-2026-19759: Google Application Integration incorrect authorization in task configuration](https://junglewise.ai/threats/cve-2026-19759-gcp-2026-064) (high, published 28 Sep 2026) - [CVE-2026-73513: Envoy Proxy multiple vulnerabilities](https://junglewise.ai/threats/cve-2026-73513-envoy-proxy-multiple-vulnerabilities) (high, CVSS 7.5, published 21 Sep 2026) - [CVE-2026-15587: Google Security Operations SOAR privilege escalation via authentication header](https://junglewise.ai/threats/cve-2026-15587-google-security-operations-soar-privilege-escalation-via) (high, published 16 Sep 2026) - [containerd CRI security context bypass in checkpoint restore](https://junglewise.ai/threats/containerd-cri-security-context-bypass-in-checkpoint-restore-d7cf36e0) (info, published 9 Sep 2026) - [CVE-2026-4644: Google Cloud Integration Connectors HTTP missing authorization](https://junglewise.ai/threats/cve-2026-4644-google-cloud-integration-connectors-http-missing-authorization) (high, published 4 Sep 2026) - [Google GKE Multi-Cloud authorization bypass in cluster registration APIs](https://junglewise.ai/threats/google-gke-multi-cloud-authorization-bypass-in-cluster-registration-af138b69) (info, published 2 Sep 2026) - [CVE-2026-12717: Google BigQuery Data Transfer Service JDBC driver input validation bypass](https://junglewise.ai/threats/cve-2026-12717-google-bigquery-data-transfer-service-jdbc-driver-input) (high, published 26 Aug 2026) - [Next.js and libheif RCE in HEIF/AVIF image processing](https://junglewise.ai/threats/next-js-and-libheif-rce-in-heif-avif-image-processing-eebb5345) (info, CVSS 9.8, published 25 Aug 2026) - [CVE-2025-31938: Intel TDX firmware confidential VM escape](https://junglewise.ai/threats/cve-2025-31938-intel-tdx-firmware-confidential-vm-escape) (high, published 11 Aug 2026) - [CVE-2026-6726: Trusted Computing Group TPM 2.0 reference implementation memory corruption](https://junglewise.ai/threats/cve-2026-6726-trusted-computing-group-tpm-2-0-reference-implementation-memory) (high, CVSS 7.9, published 11 Aug 2026) - [CVE-2026-64561: Linux KVM x86 shadow MMU privilege escalation](https://junglewise.ai/threats/cve-2026-64561-linux-kvm-x86-shadow-mmu-privilege-escalation) (high, CVSS 8.8, published 4 Aug 2026) ## Most severe Google Cloud Platform vulnerabilities - [CVE-2026-46300: Linux Kernel out-of-bounds write in skbuff coalescing](https://junglewise.ai/threats/cve-2026-46300-linux-kernel-out-of-bounds-write-in-skbuff-coalescing) (critical, exploited in the wild, CVSS 7.8, published 23 May 2026) - [CVE-2026-111497: Google Brotli buffer overflow in decoder](https://junglewise.ai/threats/cve-2026-111497-a-buffer-overflow-vulnerability-in-the-brotli-decoder-c-dec) (critical, exploited in the wild, CVSS 4, published 22 Oct 2026) - [CVE-2026-109618: PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070) (critical, exploited in the wild, published 21 Oct 2026) - [CVE-2026-59309: VMware vCenter authentication bypass in VMware Directory Service](https://junglewise.ai/threats/cve-2026-59309-vmware-vcenter-authentication-bypass-in-vmware-directory-service) (critical, CVSS 9.8, published 30 Jul 2026) - [CVE-2026-14934: Google Cloud BigQuery and Dataform auth bypass in repository creation](https://junglewise.ai/threats/cve-2026-14934-google-cloud-bigquery-and-dataform-auth-bypass-in-repository) (high, CVSS 9.4, published 13 Jul 2026) - [CVE-2026-2264: Google Cloud Apigee SSRF in SetIntegrationRequest policy](https://junglewise.ai/threats/cve-2026-2264-google-cloud-apigee-ssrf-in-setintegrationrequest-policy) (high, CVSS 9.2, published 26 May 2026) - [CVE-2026-64561: Linux KVM x86 shadow MMU privilege escalation](https://junglewise.ai/threats/cve-2026-64561-linux-kvm-x86-shadow-mmu-privilege-escalation) (high, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-15810: Google Cloud Looker XSS leading to administrative account takeover](https://junglewise.ai/threats/cve-2026-15810-google-cloud-looker-xss-leading-to-administrative-account) (high, CVSS 8.7, published 24 Jul 2026) - [CVE-2026-12715: Google Cloud Firebase Studio missing authorization in GetSignedGcsUrl RPC](https://junglewise.ai/threats/cve-2026-12715-google-cloud-firebase-studio-missing-authorization-in) (high, CVSS 8.5, published 17 Jul 2026) - [CVE-2026-6726: Trusted Computing Group TPM 2.0 reference implementation memory corruption](https://junglewise.ai/threats/cve-2026-6726-trusted-computing-group-tpm-2-0-reference-implementation-memory) (high, CVSS 7.9, published 11 Aug 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 100% on the four before (5). 2 critical against 0, 2 exploited in the wild against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 4 | 2 | 2 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Other Google technologies - [Google Chrome](https://junglewise.ai/threats/technologies/chrome): 3,930 vulnerabilities - [Google Android](https://junglewise.ai/threats/technologies/android): 628 vulnerabilities - [Google Chrome for iOS](https://junglewise.ai/threats/technologies/chrome-for-ios): 79 vulnerabilities - [Google Pixel](https://junglewise.ai/threats/technologies/google-pixel): 72 vulnerabilities - [Google Chromium V8](https://junglewise.ai/threats/technologies/chromium-v8): 41 vulnerabilities - [Google Chromium](https://junglewise.ai/threats/technologies/chromium): 37 vulnerabilities - [Google TensorFlow](https://junglewise.ai/threats/technologies/tensorflow): 31 vulnerabilities - [Google Pixel Devices](https://junglewise.ai/threats/technologies/pixel-devices): 27 vulnerabilities - [Google Pixel Firmware](https://junglewise.ai/threats/technologies/pixel-firmware): 27 vulnerabilities - [Google Android Framework](https://junglewise.ai/threats/technologies/android-framework): 22 vulnerabilities - [Google Chrome for Android](https://junglewise.ai/threats/technologies/chrome-for-android): 21 vulnerabilities - [Google ChromeOS](https://junglewise.ai/threats/technologies/chromeos): 20 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Google Cloud Platform vulnerabilities", https://junglewise.ai/threats/technologies/google-cloud-platform, 12 November 2026.