Anthropic vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20265

Newest CVEs

• CVE-2026-103435

  Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

  Anthropic · @anthropic-ai/claude-code

  High7.7
• CVE-2026-103012

  Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid…

  Anthropic · @anthropic-ai/claude-code

  Low2.0
• CVE-2026-7574

  Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use

  Anthropic · Claude Desktop Cowork

  High8.7
• CVE-2026-22561

  Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via…

  Anthropic · Claude Desktop - Windows

  Medium4.7
• CVE-2026-0621

  MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

  Anthropic · MCP TypeScript SDK

  High8.7
• CVE-2025-34072

  Anthropic Slack MCP Server Data Exfiltration via Link Unfurling

  Anthropic · Slack MCP Server

  Critical9.3