Anthropic
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| @anthropic-ai/claude-code | 2 | – | Oct 7, 2026 |
| Claude Desktop Cowork | 1 | – | Jun 23, 2026 |
| Claude Desktop - Windows | 1 | – | Mar 31, 2026 |
| MCP TypeScript SDK | 1 | – | Jan 5, 2026 |
| Slack MCP Server | 1 | – | Jul 2, 2025 |
Exploited and recent CVEs
- CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code 0.3%
- CVE-2026-103012 Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when f 0.1%
- CVE-2026-7574 Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use 0.1%
- CVE-2026-22561 Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer 0.2%
- CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS 0.4%
- CVE-2025-34072 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling 0.4%