Skip to content
Conda-forge vulnerabilities
Newest
-
conda infrastructure
Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN
CVE-2026-53942
9.9 Critical
-
conda-forge conda-forge.github.io
conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
CVE-2026-55422
4.6 Medium
-
conda-forge conda-smithy
conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository
CVE-2026-46699
7.6 High
-
conda-forge conda-smithy
conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack
CVE-2025-49824
1.7 Low
-
conda-forge conda-smithy
conda-smithy Has Incorrect Default File Permissions
CVE-2025-49843
2.7 Low
-
conda-forge conda-forge-webservices
conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
CVE-2025-49842
1.0 Low
-
conda-forge conda-forge-ci-setup-feedstock
conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing
CVE-2025-49598
4.4 Medium
-
conda-forge miniforge, openssl-feedstock +1 more
conda-forge openssl-feedstock writable OPENSSLDIR
CVE-2025-35471
7.0 High
-
conda-forge conda-forge-webservices
conda-forge-webservices has an Unauthorized Artifact Modification Race Condition
CVE-2025-32784
7.5 High
-
conda-forge infrastructure
conda-forge infrastructure uses a bad token for Azure's cf-staging access
CVE-2025-31484
9.3 Critical
-
conda-forge conda-forge-metadata
RCE in the package conda-forge-metadata
CVE-2025-27510
9.3 Critical