VULNpocalypse
InformationalVulnerabilityMonitoring

VulnCheck says Anthropic Glasswing CVEs are few, fixes lag

VulnCheck says 442 CVEs trace to Anthropic’s Glasswing, 2 exploited; check those two CVEs and treat scanner reports as unverified.

Published
Fixed in
not confirmed
Exploitation
Yes for 2 CVEs, according to VulnCheck, which says it matched Anthropic-attributed CVEs against VulnCheck KEV; no independent confirmation in the sources

Live scores

CVE-2026-61500
EPSS
0.019
some chance of attack soon
VEDAS
0.056
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet
EPSS (chance of attack)
100.1CVE-2026-61500 EPSS over time2026-082026-11-11
VEDAS (exploit evidence)
100.5CVE-2026-61500 VEDAS over time2026-082026-11-11

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-26980
EPSS
0.711
very likely to be attacked soon
VEDAS
0.984
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

What happened

According to VulnCheck, seven months into Anthropic’s Project Glasswing, its tracking shows 442 CVEs attributable to Anthropic. VulnCheck says that is about 0.5% of the 93,450 CVEs published this year. VulnCheck, the only outlet carrying this story, says it built this count from CVE records, GHSAs, Linux kernel commits and Anthropic’s own ledger. These are VulnCheck’s figures and the analysis is its author’s opinion. Anthropic’s response is not confirmed in the source.

VulnCheck reports the following about Anthropic’s public ledger, as of the ledger’s November 2nd update:

  • 37,966 total findings, of which 7,349 (19.4%) have been made public.
  • 217 marked fixed, with VulnCheck saying only 15 fixes were added since its September 8 update while findings grew by 11,813.
  • 419 withdrawn, and 1,654 (4.4%) marked as duplicates in the text. VulnCheck’s own table lists 1,670 duplicates, so the exact figure is not consistent in the source.
  • A claimed true positive rate of 94.2%, up from 90.8% at launch. VulnCheck questions how duplicates and withdrawn findings are counted.

VulnCheck says only 2 of the 442 CVEs, CVE-2026-61500 and CVE-2026-26980, appear in VulnCheck KEV (exploited in the wild), or 0.45%.

VulnCheck also says Anthropic’s OSS Scanner, announced October 8th, sends model-generated reports to maintainers without human review. Per VulnCheck, curl maintainer Daniel Stenberg received 45 reports from Anthropic, rated by Anthropic as one medium and the rest low. Of 34 published so far, VulnCheck says 19 were marked not a vulnerability, 6 confirmed as low severity and 9 await assessment.

Am I affected?

This is not a flaw in one product, so there is no single affected version. The source does not name the products behind the 442 CVEs or the two exploited ones.

  • CVE consumers: you may be affected if your software matches CVE-2026-61500 or CVE-2026-26980. Product, affected versions and fixes are not confirmed in the source. Check the NVD entries.
  • Open source maintainers: you may receive reports from Anthropic’s OSS Scanner. VulnCheck says these are fully model-generated, and in curl’s case most validated reports were not vulnerabilities or were low severity.

Not confirmed: Anthropic’s own view of VulnCheck’s analysis, independent verification of the counts, and how many of the ledger findings affect software you run.

What to do now

  1. Look up CVE-2026-61500 and CVE-2026-26980 on NVD and compare them with your asset inventory. VulnCheck says these two are listed as exploited.
  2. If you maintain a project that receives Anthropic reports, validate each one independently. Anthropic itself says, per VulnCheck, that reports may be incorrect or invalid.
  3. Consider pacing intake if volume is high. VulnCheck says curl moves its batch to GitHub gradually to ease the load on its team, and publishes low and medium findings openly.
  4. Treat claimed severity as unverified until a maintainer confirms it. VulnCheck says Claude rated 91.5% of ledger findings critical or high in September, while maintainers rated 51.3% that way.
  5. Re-check Anthropic’s ledger and VulnCheck’s tracking repo for updates, since the ledger is updated in infrequent bulk batches according to VulnCheck.

Sources