Access Control

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.CVE-2026-2031Google Cloud · CVSS 10 · 0.5% likely

   CWE-862

2. Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and WriteCVE-2026-93328Google Cloud · CVSS 9.3 · 0.5% likely

   CWE-862

3. Cross-Project Information Leakage in Google App Engine UICVE-2026-8934Google Cloud · CVSS 6.9 · 0.5% likely

   CWE-862

4. Missing Authorization in Application Integration QueryEngineTaskCVE-2026-12710Google Cloud · CVSS 9.3 · 0.4% likely

   CWE-862

5. Google Cloud Build Comment Control BypassCVE-2026-3136Google Cloud · CVSS 8.6 · 0.4% likely

   CWE-863

6. Improper Authorization in Google Cloud Application Integration Leads to Privilege EscalationCVE-2026-85298Google Cloud · CVSS 7.3 · 0.4% likely

   CWE-863

7. Improper Authorization in Google Cloud Integration Connectors Leads to Project TakeoverCVE-2026-4644Google Cloud · CVSS 8.5 · 0.4% likely

   CWE-863

8. Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab EnterpriseCVE-2026-14934Google Cloud · CVSS 9.4 · 0.4% likely

   CWE-862

9. Missing Authorization in Firebase Studio allows Cross-Tenant Source Code TheftCVE-2026-12715Google Cloud · CVSS 8.5 · 0.4% likely

   CWE-862

10. Privilege Escalation in Dialogflow CX via Webhook Admin RoleCVE-2025-12952Google Cloud · CVSS 8.7 · 0.3% likely

    CWE-269

11. Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused DeputyCVE-2026-12879Google Cloud · CVSS 5.9 · 0.3% likely

    CWE-441

12. Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.CVE-2025-13292Google Cloud · CVSS 7.6 · 0.3% likely

    CWE-269

13. Unauthorized access through stored credentials in Looker StudioCVE-2025-12405Google Cloud · CVSS 7.7 · 0.3% likely

    CWE-269

14. Missing Authorization in Compute Engine allows Cross-Project Disk ExfiltrationCVE-2026-85299Google Cloud · CVSS 8.3 · 0.3% likely

    CWE-862

15. Incorrect Authorization in Application Integration allows Internal Stubby RPC ExecutionCVE-2026-19759Google Cloud · CVSS 9.4 · 0.2% likely

    CWE-863

16. Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication HeaderCVE-2026-15587Google Cloud · CVSS 9.4 · 0.2% likely

    CWE-346

17. Cross-Site WebSocket Hijacking in Google Cloud ShellCVE-2026-85267Google Cloud · CVSS 8.7 · 0.2% likely

    CWE-1385

18. Privilege Escalation in Dialogflow CX via Playbook ImportCVE-2026-4764Google Cloud · CVSS 9.4 · 0.2% likely

    CWE-862

19. Insecure user permissions in Google Cloud Migrate to Containers for WindowsCVE-2024-9858Google Cloud · CVSS 7.8 · 0.1% likely

    CWE-276

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.