CU
Vendor
cursor
29
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73218 | CU cursor cursor | 7.7 | Aug 11 | Cursor: Sandbox escape via launching privileged containers |
| CVE-2026-73217 | CU cursor cursor | 7.7 | Aug 11 | Cursor: Sandbox escape via tampered Python virtual environments |
| CVE-2026-61613 | CU cursor cursor | 7.7 | Jul 15 | Cursor: Cloud Agent Browser Sandbox Escape |
| CVE-2026-50548 | CU cursor cursor | 9.8 | Jun 25 | Cursor Desktop sandbox escape via agent-controlled working directory |
| CVE-2026-50549 | CU cursor cursor | 9.8 | Jun 25 | Cursor Desktop sandbox escape via symlink and failed path canonicalization |
| CVE-2026-48124 | CU cursor cursor | 8.5 | Jun 15 | Cursor Desktop sandbox escape via Claude hook configuration |
| CVE-2026-31854 | CU cursor cursor | 8.8 | Mar 11 | Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass |
| CVE-2026-26268 | CU cursor cursor | 9.9 | Feb 13 | Cursor sandbox escape via Git hooks |
| CVE-2026-22708 | CU cursor cursor | 9.8 | Jan 14 | Cursor has a Terminal Tool Allowlist Bypass via Environment Variables |
| CVE-2025-62354 | CU cursor cursor | 9.8 | Nov 26 | Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those… |
| CVE-2025-64110 | CU cursor cursor | 7.5 | Nov 4 | Cursor: Authentication Bypass Possible via New Cursorignore Write |
| CVE-2025-64109 | CU cursor cursor | 8.8 | Nov 4 | Cursor CLI Beta: Command Injection via Untrusted MCP Configuration |
| CVE-2025-64108 | CU cursor cursor | 8.8 | Nov 4 | Cursor's Sensitive File Modification can Lead to NTFS Path Quirks |
| CVE-2025-64107 | CU cursor cursor | 8.8 | Nov 4 | Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows |
| CVE-2025-64106 | CU cursor cursor | 8.8 | Nov 4 | Cursor: Speedbump Modal Bypass in MCP Server Deep-Link |
| CVE-2025-59944 | CU cursor cursor | 9.8 | Oct 3 | Cursor IDE: Sensitive File Overwrite Bypass is Possible |
| CVE-2025-61593 | CU cursor cursor | 8.8 | Oct 3 | Cursor CLI Agent: Sensitive File Overwrite Bypass |
| CVE-2025-61592 | CU cursor cursor | 8.8 | Oct 3 | Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config |
| CVE-2025-61591 | CU cursor cursor | 8.8 | Oct 3 | Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution |
| CVE-2025-61590 | CU cursor cursor | 7.5 | Oct 3 | Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection |
| CVE-2025-61589 | CU cursor cursor | 5.9 | Oct 3 | Cursor: Potential Information Leakage via Mermaid Diagram |
| CVE-2025-9190 | CU Cursor Cursor | 4.8 | Aug 26 | TCC Bypass via misconfigured Node fuses in Cursor |
| CVE-2025-54130 | CU cursor cursor | 9.8 | Aug 5 | Cursor Agent is vulnerable prompt injection via Editor Special Files |
| CVE-2025-54135 | CU cursor cursor | 9.8 | Aug 5 | Cursor Agent is vulnerable to prompt injection via MCP Special Files |
| CVE-2025-54136 | CU cursor cursor | 8.8 | Aug 1 | Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals |
| CVE-2025-54133 | CU cursor cursor | 9.6 | Aug 1 | Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog |
| CVE-2025-54132 | CU cursor cursor | 7.5 | Aug 1 | Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch |
| CVE-2025-54131 | CU cursor cursor | 8.8 | Aug 1 | Cursor bypasses its allow list to execute arbitrary commands |
| CVE-2024-48919 | CU Cursor Cursor | 9.2 | Oct 22 | RCE via Prompt Injection Into Cursor's Terminal Cmd-K |