CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA and the probability of exploitation (EPSS) – each one researched individually: what is affected, what helps, what to do.

4published today

3425in the last 7 days

249of them critical

9newly exploited (7 days)

2 vulnerabilities · Vendor: Google Cloud

CVE-2026-93327Critical 9.430 Oct 2026, 16:16

Google Cloud Application Integration: Unsafe deserialization in SubWorkflow task

A deserialization of untrusted data vulnerability (CWE-502) in the SubWorkflow task of Google Cloud Application Integration allows an authenticated attacker to execute arbitrary code by sending a maliciously crafted serialized object. The flaw affects the managed service on Google Cloud Platform before 11 September 2026, and Google has already patched it. CVSS 4.0 rates it critical (9.4), but exploitation requires valid access to the service.

Google Cloud · Application Integration

CVE-2026-93328Critical 9.326 Oct 2026, 16:16

Google Cloud MCP Toolbox for Databases: Path traversal and missing authorization in cloud-storage source

Versions 1.2.0 through 1.4.0 of the MCP Toolbox for Databases contain a path traversal and missing authorization flaw in the cloud-storage source. An unauthenticated remote attacker can craft tool invocation parameters to copy host files to external Google Cloud Storage buckets and overwrite arbitrary local files. The flaw is reachable without authentication, so HTTP-exposed instances with cloud-storage tools enabled are at highest risk.

Google Cloud · MCP Toolbox for Databases

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.