CVEs for Cursor
28 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers
CVSS 7.7 highEPSS 0.63%Cursor
CVE-2026-73217 Cursor: Sandbox escape via tampered Python virtual environments
CVSS 7.7 highEPSS 0.43%Cursor
CVE-2026-61613 Cursor: Cloud Agent Browser Sandbox Escape
CVSS 7.7 highEPSS 0.68%Cursor
CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
CVSS 9.8 criticalEPSS 1.0%Cursor
CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
CVSS 9.8 criticalEPSS 1.0%Cursor
CVE-2026-48124 Cursor Desktop sandbox escape via Claude hook configuration
CVSS 8.5 highEPSS 0.14%Cursor
CVE-2026-26268 Cursor sandbox escape via Git hooks
CVSS 8.1 highEPSS 0.70%Cursor
CVE-2026-22708 Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
CVSS 9.8 criticalEPSS 0.82%Cursor
CVSS 9.8 criticalEPSS 1.4%Cursor
CVE-2025-64110 Cursor: Authentication Bypass Possible via New Cursorignore Write
CVSS 7.5 highEPSS 0.39%Cursor
CVE-2025-64109 Cursor CLI Beta: Command Injection via Untrusted MCP Configuration
CVSS 8.8 highEPSS 0.52%Cursor
CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks
CVSS 8.8 highEPSS 0.49%Cursor
CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows
CVSS 8.8 highEPSS 0.38%Cursor
CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
CVSS 8.8 highEPSS 0.39%Cursor
CVE-2025-59944 Cursor IDE: Sensitive File Overwrite Bypass is Possible
CVSS 8.1 highEPSS 0.51%Cursor
CVE-2025-61593 Cursor CLI Agent: Sensitive File Overwrite Bypass
CVSS 7.1 highEPSS 0.42%Cursor
CVE-2025-61592 Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config
CVSS 8.8 highEPSS 0.46%Cursor
CVE-2025-61590 Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection
CVSS 7.5 highEPSS 0.53%Cursor
CVE-2025-61589 Cursor: Potential Information Leakage via Mermaid Diagram
CVSS 5.9 mediumEPSS 0.29%Cursor
CVE-2025-9190 TCC Bypass via misconfigured Node fuses in Cursor
CVSS 4.8 mediumEPSS 0.16%Cursor
CVE-2025-54130 Cursor Agent is vulnerable prompt injection via Editor Special Files
CVSS 7.5 highEPSS 0.30%Cursor
CVE-2025-54135 Cursor Agent is vulnerable to prompt injection via MCP Special Files
CVSS 8.6 highEPSS 2.1%Cursor
CVE-2025-54136 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals
CVSS 7.2 highEPSS 28.5%Cursor
CVE-2025-54133 Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog
CVSS 9.6 criticalEPSS 0.41%Cursor
CVE-2025-54132 Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch
CVSS 4.4 mediumEPSS 0.38%Cursor
CVE-2025-54131 Cursor bypasses its allow list to execute arbitrary commands
CVSS 6.4 mediumEPSS 0.51%Cursor
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)