anthropics vulnerabilities

CVEs per yearBy the year they were published

1. 202512
2. 202628

Newest CVEs

• CVE-2026-88968

  Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

  anthropics · claude-code

  High7.7
• CVE-2026-88066

  Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable

  anthropics · claude-code

  High7.5
• CVE-2026-96620

  Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

  anthropics · claude-agent-sdk-python

  Critical9.2
• CVE-2026-86063

  Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

  anthropics · claude-code

  High7.5
• CVE-2026-47751

  Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

  anthropics · claude-code-action

  Medium5.3
• CVE-2026-55407

  Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

  anthropics · buffa

  Medium6.3
• CVE-2026-55406

  Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

  anthropics · buffa

  Medium5.9
• CVE-2026-55607

  Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

  anthropics · claude-code

  High7.7
• CVE-2026-46406

  Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write

  anthropics · claude-code

  Medium4.4
• CVE-2026-54316

  Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

  anthropics · claude-code

  Medium6.0