How many CVEs does Anthropic have?

Anthropic has 36 published CVE records since 2025, including 36 in the last two years.

How many Anthropic CVEs are in CISA KEV?

None of Anthropic's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Anthropic products have the most CVEs?

The Anthropic products with the most published CVEs are claude code, claude sdk for python, claude sdk for typescript, claude desktop, claude.

What are the most common weakness types in Anthropic CVEs?

Anthropic's CVEs most often map to these CWE weakness types: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-61 (UNIX Symbolic Link (Symlink) Following), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Are there public exploits for Anthropic vulnerabilities?

Yes — 8 of Anthropic's CVEs have a known public exploit.

How many critical Anthropic vulnerabilities are there?

Anthropic has 1 critical and 24 high-severity CVEs.

What is the average severity of Anthropic CVEs?

The average CVSS base score across Anthropic's scored CVEs is 7.0.

Anthropic Vulnerabilities: CVEs, CISA KEV & Security Advisories

Average CVSS: 7.0
Critical / high: 69%
Actively exploited (KEV): 0%
Public exploit available: 22%
Patch available: 97%

Anthropic Vulnerabilities

Overview

Security scorecard

Severity and exploitation

Most affected products

Common weakness types

CNAs that assign these CVEs

Disclosure activity by year

Latest Anthropic CVEs

Other vendors

Frequently asked questions

References

Track Anthropic vulnerabilities