Approved changes feed: RSS · Atom
cpe:2.3:a:google_cloud:looker:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Google Cloud (34bf7c79-23c3-583b-8203-6d0252c54ec0) |
|---|---|
| Product | Looker (06ca1cab-adec-52b5-99a3-2fe6ae822832) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15810 |
vulnerable | 2026-07-29 00:26:18.473119 |
Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a maliciously crafted URL.
Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.
Self-hosted instances must be upgraded to the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.
Published: 2026-07-24T11:04:59.022Z
Updated: 2026-07-24T12:35:11.062Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12743 |
vulnerable | 2026-06-08 07:04:30.750195 |
SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database
The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database.
Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.
Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :
* 24.12.106
* 24.18.198+
* 25.0.75
* 25.6.63+
* 25.8.45+
* 25.10.33+
* 25.12.1+
* 25.14+
Published: 2025-11-19T16:41:30.639Z
Updated: 2025-11-19T18:47:37.355Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12742 |
vulnerable | 2026-06-08 07:04:30.749764 |
Remote Code Execution in Looker via Teradata JDBC Driver
A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters.
Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.
Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :
* 24.12.108+
* 24.18.200+
* 25.0.78+
* 25.6.65+
* 25.8.47+
* 25.12.10+
* 25.14+
Published: 2025-11-25T05:38:47.907Z
Updated: 2025-11-25T14:39:05.212Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12741 |
vulnerable | 2026-06-08 07:04:30.749285 |
Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution
A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious command.
Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.
Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :
* 24.12.108+
* 24.18.200+
* 25.0.78+
* 25.6.65+
* 25.8.47+
* 25.12.10+
* 25.14+
Published: 2025-11-24T11:35:33.730Z
Updated: 2025-11-24T13:13:17.641Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12740 |
vulnerable | 2026-06-08 07:04:30.748890 |
Remote Command Execution in Looker via IBM DB2 JDBC drive
A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters.
Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.
Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :
* 25.0.93+
* 25.6.84+
* 25.12.42+
* 25.14.50+
* 25.16.44+
Published: 2025-11-24T11:30:31.958Z
Updated: 2025-11-24T13:14:36.770Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12739 |
vulnerable | 2026-06-08 07:04:30.748377 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12472 |
vulnerable | 2026-06-08 07:04:30.285362 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12414 |
vulnerable | 2026-06-08 07:04:30.201696 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12155 |
vulnerable | 2026-06-08 07:04:29.767740 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5166 |
vulnerable | 2026-06-08 06:56:15.055481 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.