conda-forge vulnerabilities
10 published CVEs name conda-forge among the affected products.
- 10Published CVEs10 of them scored
- 2Last 12 monthspublished in the last year
- 2Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-55422
conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
conda-forge · conda-forge.github.io
Medium4.6 - CVE-2026-46699
conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository
conda-forge · conda-smithy
High7.6 - CVE-2025-49824
conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack
conda-forge · conda-smithy
Low1.7 - CVE-2025-49843
conda-smithy Has Incorrect Default File Permissions
conda-forge · conda-smithy
Low2.7 - CVE-2025-49842
conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
conda-forge · conda-forge-webservices
Low1.0 - CVE-2025-49598
conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing
conda-forge · conda-forge-ci-setup-feedstock
Medium4.4 - CVE-2025-35471
conda-forge openssl-feedstock writable OPENSSLDIR
conda-forge · openssl-feedstock
High7.0 - CVE-2025-32784
conda-forge-webservices has an Unauthorized Artifact Modification Race Condition
conda-forge · conda-forge-webservices
High7.5 - CVE-2025-31484
conda-forge infrastructure uses a bad token for Azure's cf-staging access
conda-forge · infrastructure
Critical9.3 - CVE-2025-27510
RCE in the package conda-forge-metadata
conda-forge · conda-forge-metadata
Critical9.3