[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-19485":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-27T05:51:03.152Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":177,"aliases":178,"duplicate_of":9,"upstream":179,"downstream":180,"duplicates":181,"related":182,"reserved_at":9,"published_at":183,"modified_at":184,"state":185,"summary":186,"references_raw":193,"kevs":199,"epss":9,"epss_history":200,"metrics":201,"affected":208},"CVE-2026-19485","A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names.\n\n\n\nThis vulnerability was patched and no customer action is needed.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-330","Use of Insufficiently Random Values","The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.","weakness","Stable","Class","High",[20,145,173],{"id":21,"name":22,"techniques":23},"CAPEC-112","Brute Force",[24],{"id":25,"name":22,"tactics":26,"countermeasures":30},"T1110",[27],{"id":28,"name":29},"TA0031","Credential Access",[31,36,40,44,49,54,59,63,67,71,75,79,84,88,92,96,100,104,108,112,116,120,124,128,132,136,141],{"id":32,"name":33,"tactic":34},"D3-APCA","Application Protocol Command Analysis",{"name":35},"Detect",{"id":37,"name":38,"tactic":39},"D3-ANAA","Administrative Network Activity Analysis",{"name":35},{"id":41,"name":42,"tactic":43},"D3-CAA","Connection Attempt Analysis",{"name":35},{"id":45,"name":46,"tactic":47},"D3-RIC","Reissue Credential",{"name":48},"Restore",{"id":50,"name":51,"tactic":52},"D3-DUC","Decoy User Credential",{"name":53},"Deceive",{"id":55,"name":56,"tactic":57},"D3-CH","Credential Hardening",{"name":58},"Harden",{"id":60,"name":61,"tactic":62},"D3-MFA","Multi-factor Authentication",{"name":58},{"id":64,"name":65,"tactic":66},"D3-CRO","Credential Rotation",{"name":58},{"id":68,"name":69,"tactic":70},"D3-AEM","Application Exception Monitoring",{"name":35},{"id":72,"name":73,"tactic":74},"D3-OPM","Operational Process Monitoring",{"name":35},{"id":76,"name":77,"tactic":78},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":35},{"id":80,"name":81,"tactic":82},"D3-NTF","Network Traffic Filtering",{"name":83},"Isolate",{"id":85,"name":86,"tactic":87},"D3-NTCD","Network Traffic Community Deviation",{"name":35},{"id":89,"name":90,"tactic":91},"D3-RTSD","Remote Terminal Session Detection",{"name":35},{"id":93,"name":94,"tactic":95},"D3-PR","Password Rotation",{"name":58},{"id":97,"name":98,"tactic":99},"D3-PWA","Password Authentication",{"name":58},{"id":101,"name":102,"tactic":103},"D3-CDP","Change Default Password",{"name":58},{"id":105,"name":106,"tactic":107},"D3-SPP","Strong Password Policy",{"name":58},{"id":109,"name":110,"tactic":111},"D3-OTP","One-time Password",{"name":58},{"id":113,"name":114,"tactic":115},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":35},{"id":117,"name":118,"tactic":119},"D3-CCSA","Credential Compromise Scope Analysis",{"name":35},{"id":121,"name":122,"tactic":123},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":35},{"id":125,"name":126,"tactic":127},"D3-NTSA","Network Traffic Signature Analysis",{"name":35},{"id":129,"name":130,"tactic":131},"D3-CSPP","Client-server Payload Profiling",{"name":35},{"id":133,"name":134,"tactic":135},"D3-CTS","Credential Transmission Scoping",{"name":83},{"id":137,"name":138,"tactic":139},"D3-CR","Credential Revocation",{"name":140},"Evict",{"id":142,"name":143,"tactic":144},"D3-ANCI","Authentication Cache Invalidation",{"name":140},{"id":146,"name":147,"techniques":148},"CAPEC-485","Signature Spoofing by Key Recreation",[149],{"id":150,"name":151,"tactics":152,"countermeasures":154},"T1552.004","Private Keys",[153],{"id":28,"name":29},[155,157,159,161,163,165,167,169,171],{"id":133,"name":134,"tactic":156},{"name":83},{"id":55,"name":56,"tactic":158},{"name":58},{"id":45,"name":46,"tactic":160},{"name":48},{"id":50,"name":51,"tactic":162},{"name":53},{"id":137,"name":138,"tactic":164},{"name":140},{"id":117,"name":118,"tactic":166},{"name":35},{"id":60,"name":61,"tactic":168},{"name":58},{"id":64,"name":65,"tactic":170},{"name":58},{"id":142,"name":143,"tactic":172},{"name":140},{"id":174,"name":175,"techniques":176},"CAPEC-59","Session Credential Falsification through Prediction",[],[],[],[],[],[],[],"2026-08-26T18:06:00.596Z","2026-08-26T19:04:26.776Z","Received",{"cisa_kev":187,"cisa_ransomware":187,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":188,"severity_score":189,"severity_version":190,"severity_source":191,"severity_vector":192,"severity_status":185},false,"critical",9.3,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/U:Clear",[194],{"url":195,"sources":196,"tags":198},"https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/",[191,197],"nvd",[],[],[],[202,205],{"source":191,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":203},{"baseScore":189,"baseSeverity":204,"vectorString":192,"impactScore":9,"exploitabilityScore":9},"CRITICAL",{"source":197,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":206},{"baseScore":189,"baseSeverity":204,"vectorString":207,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear",[209],{"ecosystem":9,"name":210,"vendor":211,"product":212,"cpe_part":213,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":214},"Vertex AI Search for Commerce","google cloud","vertex ai search for commerce","a",[215],{"version":216,"is_range":217,"range_type":191,"version_start":9,"version_start_type":9,"version_end":218,"version_end_type":219,"fixed_in":9},"\u003C 2026-04-27",true,"2026-04-27","excluding"]