claude-code
2 live · 20 on record · last incident 2 days ago
Live2
- liveClaude Code + SDKs Stolen Claude API keys turn Claude Code into a remote implant
Research · since 12 Nov 2026
Darktrace researchers demonstrated how stolen API keys can turn Claude Code into a remote implant. The technique abuses the memory stores feature and Files API to exfiltrate data while disguising traffic as normal coding agent activity.
AI - liveClaude Code + SDKs Claude Code Inadvertently Leaks Credentials to Public Repositories
Research · since 10 Nov 2026
Researchers demonstrated that an AI coding tool command accidentally saves files containing credentials to public repositories. Organizations utilizing the tool face potential exposure of sensitive internal data.
Do:Review public repositories for accidentally committed credential files created by development tools.
AI
Earlier18
- closed8.2praktor CVE-2026-62331: praktor Path Traversal Vulnerability
Patch now · Disclosed · Patched · since 30 Oct 2026 · CVE-2026-62331
AI - closedClaude Code Desktop Anthropic Claude Code Desktop Preview Pane Credential Theft Flaw
Patch now · Disclosed · since 14 Oct 2026
AI - closed7.5Claude Code + SDKs CVE-2026-86063: Claude Code plugin installation flow hash pin bypass vulnerability
Patch now · Disclosed · since 13 Oct 2026 · updated 15 Oct 2026 · CVE-2026-86063
AI - closed2.0Claude Code + SDKs CVE-2026-103012: Claude Code API Key Precedence Policy Bypass
Patch now · Disclosed · since 30 Sep 2026 · CVE-2026-103012
AI - closed8.6OpenClaw CVE-2026-100585: OpenClaw bypasses owner-only authorization for Claude Code prompts
Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100585
AI - closed8.8Claude Code Templates CVE-2026-73222: Claude Code Templates Studio Server Unauthenticated Execution
Patch now · Disclosed · since 11 Aug 2026 · CVE-2026-73222
AI - closedClaude Code GitHub Action Claude Code GitHub Action Secret Exposure via Prompt Injection
Research · since 5 Jun 2026
AI - closed4.4Claude Code + SDKs CVE-2026-46406: Anthropic Claude Code Insecure Temporary File Handling in Copy Command
Patch now · Disclosed · since 25 Jun 2026 · updated 29 Jun 2026 · CVE-2026-46406
AI - closed9.1Claude Code + SDKs CVE-2026-54316: Claude Code Out-of-Band Data Exfiltration via WebFetch
Patch now · Disclosed · since 17 Jun 2026 · updated 23 Jun 2026 · CVE-2026-54316
AI - closedClaude Code + SDKs Threat Actor Used AI Agents to Breach Healthcare Organizations in Argentina
Breaches & attacks · Exploited · since 19 May 2026
AI - closed8.7Claude Code UI Cloud CLI command injection vulnerability in git-config endpoint
Patch now · Disclosed · since 11 Mar 2026 · CVE-2026-31861
AI - closed7.7Claude Code + SDKs CVE-2026-25722: Claude Code Directory Change Write Protection Bypass
Patch now · Disclosed · since 6 Feb 2026 · CVE-2026-25722
AI - closed7.7Claude Code + SDKs CVE-2026-25723: Claude Code Command Injection Bypass
Patch now · Disclosed · since 6 Feb 2026 · CVE-2026-25723
AI - closed8.7Claude Code + SDKs CVE-2025-64755: Anthropic Claude Code Sed Command Validation Bypass
Patch now · Disclosed · since 20 Nov 2025 · updated 21 Nov 2025 · CVE-2025-64755
AI - closed7.7Claude Code + SDKs CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialog
Patch now · Disclosed · since 19 Nov 2025 · CVE-2025-65099
AI - closed7.7Claude Code + SDKs CVE-2025-59828: Claude Code vulnerable to arbitrary code execution via Yarn
Patch now · Disclosed · since 24 Sep 2025 · CVE-2025-59828
AI - closed8.7Claude Code + SDKs CVE-2025-54795: Claude Code Command Prompt Execution Bypass
Patch now · Disclosed · since 4 Aug 2025 · updated 5 Aug 2025 · CVE-2025-54795
AI - closed7.7Claude Code + SDKs CVE-2025-54794: Claude Code Path Restriction Bypass Vulnerability
Patch now · Disclosed · since 4 Aug 2025 · updated 5 Aug 2025 · CVE-2025-54794
AI