# Cursor CVEs > Cursor: 28 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/cursor/cves Last updated: 2026-08-11T17:47:29Z 28 CVEs map to Cursor (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Cursor](https://rewindex.com/company/cursor.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Cursor’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-08-11 | [CVE-2026-73218](https://rewindex.com/cve/CVE-2026-73218.md) | Cursor: Sandbox escape via launching privileged containers | 7.7 high | | | 2026-08-11 | [CVE-2026-73217](https://rewindex.com/cve/CVE-2026-73217.md) | Cursor: Sandbox escape via tampered Python virtual environments | 7.7 high | | | 2026-07-15 | [CVE-2026-61613](https://rewindex.com/cve/CVE-2026-61613.md) | Cursor: Cloud Agent Browser Sandbox Escape | 7.7 high | | | 2026-06-25 | [CVE-2026-50548](https://rewindex.com/cve/CVE-2026-50548.md) | Cursor Desktop sandbox escape via agent-controlled working directory | 9.8 critical | | | 2026-06-25 | [CVE-2026-50549](https://rewindex.com/cve/CVE-2026-50549.md) | Cursor Desktop sandbox escape via symlink and failed path canonicalization | 9.8 critical | | | 2026-06-15 | [CVE-2026-48124](https://rewindex.com/cve/CVE-2026-48124.md) | Cursor Desktop sandbox escape via Claude hook configuration | 8.5 high | | | 2026-03-11 | [CVE-2026-31854](https://rewindex.com/cve/CVE-2026-31854.md) | Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass | 8.8 high | | | 2026-02-13 | [CVE-2026-26268](https://rewindex.com/cve/CVE-2026-26268.md) | Cursor sandbox escape via Git hooks | 8.1 high | | | 2026-01-14 | [CVE-2026-22708](https://rewindex.com/cve/CVE-2026-22708.md) | Cursor has a Terminal Tool Allowlist Bypass via Environment Variables | 9.8 critical | | | 2025-11-26 | [CVE-2025-62354](https://rewindex.com/cve/CVE-2025-62354.md) | | 9.8 critical | | | 2025-11-04 | [CVE-2025-64110](https://rewindex.com/cve/CVE-2025-64110.md) | Cursor: Authentication Bypass Possible via New Cursorignore Write | 7.5 high | | | 2025-11-04 | [CVE-2025-64109](https://rewindex.com/cve/CVE-2025-64109.md) | Cursor CLI Beta: Command Injection via Untrusted MCP Configuration | 8.8 high | | | 2025-11-04 | [CVE-2025-64108](https://rewindex.com/cve/CVE-2025-64108.md) | Cursor's Sensitive File Modification can Lead to NTFS Path Quirks | 8.8 high | | | 2025-11-04 | [CVE-2025-64107](https://rewindex.com/cve/CVE-2025-64107.md) | Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows | 8.8 high | | | 2025-11-04 | [CVE-2025-64106](https://rewindex.com/cve/CVE-2025-64106.md) | Cursor: Speedbump Modal Bypass in MCP Server Deep-Link | 8.8 high | | | 2025-10-03 | [CVE-2025-59944](https://rewindex.com/cve/CVE-2025-59944.md) | Cursor IDE: Sensitive File Overwrite Bypass is Possible | 8.1 high | | | 2025-10-03 | [CVE-2025-61593](https://rewindex.com/cve/CVE-2025-61593.md) | Cursor CLI Agent: Sensitive File Overwrite Bypass | 7.1 high | | | 2025-10-03 | [CVE-2025-61592](https://rewindex.com/cve/CVE-2025-61592.md) | Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config | 8.8 high | | | 2025-10-03 | [CVE-2025-61591](https://rewindex.com/cve/CVE-2025-61591.md) | Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution | 8.8 high | | | 2025-10-03 | [CVE-2025-61590](https://rewindex.com/cve/CVE-2025-61590.md) | Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection | 7.5 high | | | 2025-10-03 | [CVE-2025-61589](https://rewindex.com/cve/CVE-2025-61589.md) | Cursor: Potential Information Leakage via Mermaid Diagram | 5.9 medium | | | 2025-08-26 | [CVE-2025-9190](https://rewindex.com/cve/CVE-2025-9190.md) | TCC Bypass via misconfigured Node fuses in Cursor | 4.8 medium | | | 2025-08-05 | [CVE-2025-54130](https://rewindex.com/cve/CVE-2025-54130.md) | Cursor Agent is vulnerable prompt injection via Editor Special Files | 7.5 high | | | 2025-08-05 | [CVE-2025-54135](https://rewindex.com/cve/CVE-2025-54135.md) | Cursor Agent is vulnerable to prompt injection via MCP Special Files | 8.6 high | | | 2025-08-01 | [CVE-2025-54136](https://rewindex.com/cve/CVE-2025-54136.md) | Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals | 7.2 high | | | 2025-08-01 | [CVE-2025-54133](https://rewindex.com/cve/CVE-2025-54133.md) | Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog | 9.6 critical | | | 2025-08-01 | [CVE-2025-54132](https://rewindex.com/cve/CVE-2025-54132.md) | Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch | 4.4 medium | | | 2025-08-01 | [CVE-2025-54131](https://rewindex.com/cve/CVE-2025-54131.md) | Cursor bypasses its allow list to execute arbitrary commands | 6.4 medium | | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Cursor) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 5 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 1 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-06-22 | 2 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/cursor/cves · Markdown: https://rewindex.com/company/cursor/cves.md · JSON: https://rewindex.com/api/v1/companies/cursor/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:01:54.959Z