Approved changes feed: RSS · Atom
cpe:2.3:a:google_cloud:dataform:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Google Cloud (34bf7c79-23c3-583b-8203-6d0252c54ec0) |
|---|---|
| Product | Dataform (c861067b-b839-54ea-945c-ce1790223f49) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14934 |
vulnerable | 2026-07-29 00:26:17.655438 |
Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover.
This vulnerability was patched on 10 May 2026, and no customer action is needed.
Published: 2026-07-13T10:20:19.121Z
Updated: 2026-07-13T13:12:16.784Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9118 |
vulnerable | 2026-06-08 07:45:21.750783 |
Dataform Path Traversal
A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.
Published: 2025-08-25T07:05:31.047Z
Updated: 2025-08-25T13:48:40.821Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.