Back to updates
UpdatedSep 3, 2026

Anthropic-Credited-CVEs — Updated!

Tracking Vulnerabilities That Appear to be Credited to the Anthropic Research Team

Share

ANTHROPIC CVE TRACKER

Overview

Tracking vulnerabilities that credit the Anthropic research team and are possibly discovered by Project Glasswing.

CURRENT CVE COUNT: 149

Initial Research

Tracking CVEs Attributed to Anthropic Researchers and Project Glasswing

Add a Vulnerability

If you find an Anthropic credited vulnerability, please open a Pull Request or Send me a message on linkedin or in the Extended Vulnerability Community Discord.

Considerations

This project is maintained on a best effort basis.

CVSS Severity Distribution

CVSS severity distribution

The List

CVEDateVendorProductCVSSCredit
CVE-2026-162392026-08-13n/aPostgreSQL8.8The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem.
CVE-2026-157422026-08-13n/aPostgreSQL8.8The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem.
CVE-2026-157412026-08-13n/aPostgreSQL8.8The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem.
CVE-2026-687602026-08-12jfrogartifactory5.3Ben Morris in collaboration with Claude and Anthropic Research
CVE-2026-186632026-08-12Red HatRed Hat Directory Server 115.9Red Hat would like to thank Adam Korczynski (Ada Logics), Arthur Chan (Ada Logics), David Korczynski (Ada Logics), and Team (Anthropic) for reporting this issue.
CVE-2026-118362026-08-04CaliptraCore ROM1.8Alex Matrosov with Claude, Anthropic
CVE-2026-118352026-08-04CaliptraCore ROM5.6Alex Matrosov with Claude, Anthropic
CVE-2026-596522026-08-03Legion of the Bouncy Castle Inc.BC-JAVA6.9Alex Gaynor in collaboration with Claude and Anthropic Research
CVE-2026-580632026-08-03Legion of the Bouncy Castle Inc.BC-JAVA5.3Alex Gaynor in collaboration with Claude and Anthropic Research
CVE-2026-580622026-08-03Legion of the Bouncy Castle Inc.BC-JAVA9.3Alex Gaynor in collaboration with Claude and Anthropic Research
CVE-2026-580612026-08-03Legion of the Bouncy Castle Inc.BC-JAVA8.7Alex Gaynor in collaboration with Claude and Anthropic Research
CVE-2026-580602026-08-03Legion of the Bouncy Castle Inc.BC-JAVA8.7Alex Gaynor in collaboration with Claude and Anthropic Research
CVE-2026-580592026-08-03Legion of the Bouncy Castle Inc.BC-JAVA8.7Alex Gaynor in collaboration with Claude and Anthropic Research
CVE-2026-87632026-08-03Legion of the Bouncy Castle Inc.BC-JAVA9.3Alex Gaynor in collaboration with Claude and Anthropic Research
CVE-2026-614872026-07-28Apache Software FoundationApache ActiveMQ Broker6.5Claude and Ada Logics
CVE-2026-640152026-07-19LinuxLinux7.8
CVE-2026-466392026-07-14twigphpTwig7.1Twig would like to thank Anvil Secure in collaboration with Claude and Anthropic Research for reporting and fixing the issue.
CVE-2026-466332026-07-14twigphpTwig8.7Twig would like to thank Anvil Secure in collaboration with Claude and Anthropic Research for reporting and fixing the issue.
CVE-2026-450672026-07-14symfonysymfony6.3
CVE-2026-615052026-07-13rejettohfs6.9Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research
CVE-2026-615042026-07-13rejettohfs5.1Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research
CVE-2026-615032026-07-13rejettohfs6.9Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research
CVE-2026-615022026-07-13rejettohfs5.1Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research
CVE-2026-615012026-07-13rejettohfs5.3Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research
CVE-2026-615002026-07-13rejettohfs9.3Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research
CVE-2026-151702026-07-08Wireshark FoundationWireshark5.5Claude and Ada Logics
CVE-2026-151692026-07-08Wireshark FoundationWireshark5.5Claude and Ada Logics
CVE-2026-151662026-07-08Wireshark FoundationWireshark5.5Claude and Ada Logics
CVE-2026-151652026-07-08Wireshark FoundationWireshark5.5Claude and Ada Logics
CVE-2026-463542026-07-07codercoder9.1We'd like to thank Ben Tran of calif.io and Anthropic’s Security Team (ANT-2026-22445) for independently disclosing this issue!
CVE-2026-457962026-07-07codercoder6.5We'd like to thank Ben Tran of calif.io and Anthropic's Security Team (ANT-2026-22447) for independently disclosing this issue!
CVE-2026-277752026-07-03GiteaGitea Open Source Git Server8.8adrian-doyensec
CVE-2026-437152026-06-29AppleIOS8.8Milad Nasr and Nicholas Carlini with Claude, Anthropic
CVE-2026-123402026-06-25wolfSSLwolfSSL6.3David Pokora, Trail of Bits (in collaboration with Anthropic)
CVE-2026-75312026-06-25wolfSSLwolfSSL2.3Thai Duong (Calif.io / Anthropic)
CVE-2026-75112026-06-25wolfSSLwolfSSL5.9Nicholas Carlini from Anthropic
CVE-2026-66812026-06-25wolfSSLwolfSSL1.0Nicholas Carlini from Anthropic
CVE-2026-66792026-06-25wolfSSLwolfSSL8.8Nicholas Carlini from Anthropic
CVE-2026-63312026-06-25wolfSSLwolfSSL2.1Nicholas Carlini from Anthropic
CVE-2026-63302026-06-25wolfSSLwolfSSL6.3Nicholas Carlini from Anthropic
CVE-2026-63292026-06-25wolfSSLwolfSSL6.0Nicholas Carlini from Anthropic
CVE-2026-463492026-06-24mastodonmastodon5.3Anthropic Advisory NOT IN CVE TABLE
CVE-2026-463482026-06-24mastodonmastodon8.7Anthropic Advisory NOT IN CVE TABLE
CVE-2026-83582026-06-15The Document FoundationLibreOffice5.4Anthropic (automated discovery using Claude) | Arthur Chan of Ada Logics (validation and reporting)
CVE-2026-83572026-06-15The Document FoundationLibreOffice5.4Anthropic (automated discovery using Claude) | Arthur Chan of Ada Logics (validation and reporting)
CVE-2026-83562026-06-15The Document FoundationLibreOffice5.4Anthropic (automated discovery using Claude) | Arthur Chan of Ada Logics (validation and reporting)
CVE-2026-60472026-06-15The Document FoundationLibreOffice5.4Anthropic (automated discovery using Claude) | Trail of Bits (triage and validation)
CVE-2026-60452026-06-15The Document FoundationLibreOffice5.4Anthropic (automated discovery using Claude) | Trail of Bits (triage and validation)
CVE-2026-60402026-06-15The Document FoundationLibreOffice5.4Anthropic (automated discovery using Claude) | Trail of Bits (triage and validation)
CVE-2026-60392026-06-15The Document FoundationLibreOffice5.4Anthropic (automated discovery using Claude) | Trail of Bits (triage and validation)
CVE-2026-454472026-06-09OpenSSLOpenSSL8.8Thai Duong (Calif.io in collaboration with Claude and Anthropic Research) | Igor Ustinov
CVE-2026-454462026-06-09OpenSSLOpenSSL4.8Alex Gaynor (Anthropic) | Dmitry Belyavskiy (Red Hat)
CVE-2026-454452026-06-09OpenSSLOpenSSL7.5Alex Gaynor (Anthropic) | Viktor Dukhovni
CVE-2026-427702026-06-09OpenSSLOpenSSL3.7Alex Gaynor (Anthropic) | Alex Gaynor (Anthropic) | Viktor Dukhovni | Norbert Pócs
CVE-2026-427692026-06-09OpenSSLOpenSSL5.3Alex Gaynor (Anthropic) | Alex Gaynor (Anthropic) | Bob Beck
CVE-2026-427682026-06-09OpenSSLOpenSSL3.7Alex Gaynor (Anthropic) | Dmitry Belyavskiy (Red Hat) | Alicja Kario (Red Hat)
CVE-2026-341822026-06-09OpenSSLOpenSSL9.1Asim Viladi Oglu Manizada | Alex Gaynor (Anthropic) | Ying Dong | Haiyang Huang | Neil Horman
CVE-2026-341812026-06-09OpenSSLOpenSSL7.4Pavol Žáčik (Red Hat) | Alex Gaynor (Anthropic) | Alicja Kario (Red Hat)
CVE-2026-499752026-06-08Apache Software FoundationApache HTTP Server7.5Quang Luong of Calif.IO in collaboration with OpenAI Codex
CVE-2026-473452026-06-08TYPO3HTML Sanitizer5.1Doyensec in collaboration with Claude and Anthropic Research | Benjamin Franzke
CVE-2026-477322026-06-05twigtwig7.1@fabpot (remediation_developer)
CVE-2026-472502026-06-05npmmcp-server-kubernetes6.1@yotampe-pluto (reporter)
CVE-2026-84622026-06-04github.comopenmeterio/openmeter
CVE-2026-474292026-06-01npmvitest9.8@sapphi-red (reporter) | @qispark (analyst) | @joevin-slq-docto (analyst) | @koteswar-k (analyst) | @SaronGrave (analyst) | @jason-anthropic (analyst)
CVE-2026-473912026-05-29pipPraisonAI9.8@foxirain (reporter)
CVE-2026-457002026-05-29FreeRDPFreeRDP7.7Anthropic Advisory NOT IN CVE TABLE
CVE-2026-444202026-05-29FreeRDPFreeRDP8.8Anthropic Advisory NOT IN CVE TABLE
CVE-2026-405282026-05-29OpenSCOpenSC1.0Nicholas Carlini of Anthropic
CVE-2026-405102026-05-29OpenSCOpenSC1.0Nicholas Carlini of Anthropic
CVE-2026-488962026-05-26Joomla!Joomla! CMS8.2Doyensec in collaboration with Claude and Anthropic Research
CVE-2026-414012026-05-26libyanglibyang6.9https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing
CVE-2026-403842026-05-26Joomla!Joomla! CMS5.9Doyensec in collaboration with Claude and Anthropic Research
CVE-2026-403832026-05-26Joomla!Joomla! CMS7.5Doyensec in collaboration with Claude and Anthropic Research
CVE-2026-400342026-05-26gitoxidegitoxide7.3https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule
CVE-2026-400332026-05-26FreeRDPFreeRDP8.6https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-in-gdi-cachetosurface-via-rectangle-validation-bypass
CVE-2026-442122026-05-14PrestaShopPrestaShop7.8Reported by Savio at Doyensec ([email protected]) in collaboration with Anthropic Research.
CVE-2026-64792026-05-14PostgreSQLPostgreSQL7.5The PostgreSQL project thanks Calif.io in collaboration with Claude and Anthropic Research for reporting this problem.
CVE-2026-444712026-05-13gitoxidegitoxide7.8This vulnerability was found by AI (specifically, Claude Mythos) as part of Project Glasswing. I have verified this and most of this advisory has been written by my probably-inferior human brain.
CVE-2026-404032026-05-12MicrosoftWindows8.8Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-403982026-05-12MicrosoftWindows8.0Calif.io and Milad Nasr (Anthropic) with Claude with Calif.io and Anthropic
CVE-2026-403802026-05-12MicrosoftWindows6.2Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-403692026-05-12MicrosoftWindows7.8Calif.io in collaboration with Claude and Anthropic Research Adrian Denkiewicz at Doyensec in collaboration with Anthropic Research https://doyensec.com/ Len Sadowski (lytnc) https://sec-fault.com/ and Oguz Bektas (ozb) https://ozbsec.com/
CVE-2026-74742026-05-12HashiCorpNomad8.8This issue was reported to HashiCorp by Adrian Denkiewicz at Doyensec in collaboration with Claude and Anthropic Research
CVE-2026-426002026-05-11miniominio6.9Anthropic Advisory NOT IN CVE TABLE
CVE-2026-289522026-05-11AppleIphone/Ipad7.5Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-289422026-05-11AppleWebkit6.5Milad Nasr and Nicholas Carlini with Claude, Anthropic
CVE-2026-431852026-05-06LinuxLinux9.8Signed-off-by: Nicholas Carlini [email protected]
CVE-2026-315542026-04-24LinuxLinux7.8Reported-by: Nicholas Carlini [email protected]
CVE-2026-419902026-04-23gnupgLibgcrypt4.0Reported by Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-63862026-04-22FreeBSDFreeBSD6.2Nicholas Carlini using Claude, Anthropic
CVE-2026-53982026-04-22FreeBSDFreeBSD8.4Nicholas Carlini using Claude, Anthropic
CVE-2026-67582026-04-21MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-67572026-04-21MozillaFirefox7.5Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-67462026-04-21MozillaFirefox7.5Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-55882026-04-15Legion of the Bouncy Castle Inc.BC-JAVA6.3Nicholas Carlini using Claude, Anthropic
CVE-2026-330962026-04-14MicrosoftWindows7.5Milad Nasr (Anthropic) and Calif.io with Claude
CVE-2026-339012026-04-13ImageMagickImageMagick7.5Anthropic Advisory NOT IN CVE TABLE
CVE-2026-323162026-04-13jqlangJQ7.5Anthropic Advisory
CVE-2026-55012026-04-10wolfSSLwolfSSL8.6Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-55002026-04-10wolfSSLwolfSSL8.7Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-54792026-04-10wolfSSLwolfSSL7.6Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-54772026-04-10wolfSSLwolfSSL8.2Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-54662026-04-10wolfSSLwolfSSL7.6Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-55032026-04-09wolfSSLwolfSSL6.9Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-54482026-04-09wolfSSLwolfSSL2.3Anthropic Advisory
CVE-2026-54472026-04-09wolfSSLwolfSSL6.3Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-54462026-04-09wolfSSLwolfSSL6.0Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-51942026-04-09wolfSSLwolfSSL9.3Nicholas Carlini from Anthropic
CVE-2026-345802026-04-07BotanBotan7.5Nicholas Carlini with Claude, Anthropic
CVE-2026-283862026-04-07OpenSSLOpenSSL9.1Stanislav Fort (Aisle Research); Pavel Kohout (Aisle Research); Alex Gaynor (Anthropic)
CVE-2026-57472026-04-07AWSFireCracker8.7We thank Anthropic for reporting this concern to the AWS Vulnerability Disclosure Program.
CVE-2026-35022Reserved
CVE-2026-314022026-04-03LinuxLinux9.8Reported-by: Nicholas Carlini [email protected]
CVE-2026-51992026-04-01temporaliotemporal2.3Anthropic Advisory
CVE-2026-337212026-03-26MapServerMapServer5.3Anthropic Advisory
CVE-2026-47472026-03-26FreeBSDFreeBSD8.8Nicholas Carlini using Claude, Anthropic
CVE-2026-276542026-03-24F5NGINX Plus8.2Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-47242026-03-24MozillaFirefox9.1Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-47232026-03-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-47182026-03-24MozillaFirefox8.1Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-47052026-03-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-47042026-03-24MozillaFirefox7.5Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-47022026-03-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-46002026-03-23jsrsasignjsrsasign9.1reported by Koda Reef, Nicholas Carlini and @Kr0emer
CVE-2026-322672026-03-16craftcmscms7.7Anthropic Advisory
CVE-2026-282082026-02-26junrarjunrar5.9Anthropic Advisory
CVE-2026-28052026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-28042026-02-24MozillaFirefox5.4Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27992026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27972026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27962026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27912026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27892026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27882026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27872026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27862026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27852026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27752026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27742026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27732026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27722026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27712026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27702026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27692026-02-24MozillaFirefox8.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27662026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27652026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27642026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-27632026-02-24MozillaFirefox9.8Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
CVE-2026-269802026-02-19GhostGhost9.4We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly.
Read more

Categories

Vulnerability AnalysisThreat IntelligenceCurated Resources