https://vulnogram.org/ Most recent CVEs assigned by Anthropic, PBC (anthropic). https://vulnogram.org/seaview/icons/anthropic.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT https://vulnogram.org/CVE-2026-103658 https://vulnogram.org/CVE-2026-103658 GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), s… Medium Mon, 12 Oct 2026 21:24:48 GMT https://vulnogram.org/CVE-2026-103435 https://vulnogram.org/CVE-2026-103435 Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an a… High Wed, 07 Oct 2026 12:50:02 GMT https://vulnogram.org/CVE-2026-101283 https://vulnogram.org/CVE-2026-101283 iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an o… Critical Network Exploitable Wed, 30 Sep 2026 21:32:14 GMT https://vulnogram.org/CVE-2026-101276 https://vulnogram.org/CVE-2026-101276 iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream;… Critical Network Exploitable Wed, 30 Sep 2026 21:11:52 GMT https://vulnogram.org/CVE-2026-103012 https://vulnogram.org/CVE-2026-103012 Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings… Low Wed, 30 Sep 2026 11:30:38 GMT