Read the docs

Google

Records17248All Threatist records
Exploited (KEV)99In CISA KEV
CVSS critical1626CVSS 9.0–10.0
CVSS high7971CVSS 7.0–8.9

Exploited now

Google records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-42236 Google Pixel Improper Authorization Vulnerability Priority CRITICAL 97KEV 2026-09-16TI-2026-59711 Google Chromium V8 Out of Bounds Write Vulnerability Priority CRITICAL 97KEV 2026-09-09TI-2026-58426 Google Chromium V8 Type Confusion Vulnerability Priority CRITICAL 97KEV 2026-09-04TI-2026-10055 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Priority CRITICAL 97KEV 2026-06-09TI-2025-30872 Android Framework Integer Overflow Vulnerability Priority CRITICAL 96KEV 2026-06-02

Components

Products in the NVD configurations · select one to filter the records
Android 8411 records CRITICAL Chrome 7587 records CRITICAL Tensorflow 431 records HIGH Chrome Os 67 records HIGH V8 34 records CRITICAL Asylo 16 records MEDIUM Blink 12 records MEDIUM Mcp Toolbox For Databases 11 records MEDIUM

Records

11 records in Mcp Toolbox For Databases · all components

TI-2026-10122 CVE-2026-11718 · GHSA-wcpr-6g7x-p44r

Improper authentication in Google MCP Toolbox for Databases

Priority MEDIUM 47

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00185 Published 2026-06-18 Fixed in 1.4.0 CWE-287
TI-2026-10121 CVE-2026-11717 · GHSA-8fcc-w5hv-4gxv

Improper authentication in Google MCP Toolbox for Databases

Priority MEDIUM 47

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00176 Published 2026-06-18 Fixed in 1.4.0 CWE-287
TI-2026-12267 CVE-2026-14537 · GHSA-f8h2-c55w-8m5p

Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints

Priority MEDIUM 43

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sendi…

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00252 Published 2026-07-31 No fix listed CWE-863
TI-2026-13310 CVE-2026-15829 · GHSA-wvx3-gvxv-cmxc

SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

Priority LOW 39

A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00197 Published 2026-07-21 No fix listed CWE-863
TI-2026-10123 CVE-2026-11719 · GHSA-5gf6-gc35-xjpc

Missing authorization in Google MCP Toolbox for Databases

Priority LOW 38

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00145 Published 2026-06-18 Fixed in 1.4.0 CWE-862
TI-2026-12269 CVE-2026-14539 · GHSA-623p-8r6m-hwc6

Denial of Service via Unrestricted Payload Buffering in MCP Toolbox

Priority LOW 35

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS).

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00238 Published 2026-07-31 No fix listed CWE-770
TI-2026-13765 CVE-2026-16481 · GHSA-qr8r-mqp7-36xx

Server-side request forgery in Google MCP Toolbox for Databases

Priority LOW 26

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00193 Published 2026-07-27 No fix listed CWE-918
TI-2026-12268 CVE-2026-14538 · GHSA-24pp-m59v-92j8

BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox

Priority LOW 25

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatase…

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00204 Published 2026-07-31 No fix listed CWE-285
Open these records in search →