Vendor
Conda-forge
10 known vulnerabilities in products by Conda-forge, 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-27510 | RCE in the package conda-forge-metadata | — | |
| Critical | CVE-2025-31484 | conda-forge infrastructure uses a bad token for Azure's cf-staging access | — | |
| High | CVE-2026-46699 | Conda-forge Conda-smithy: Improper Access Control | 7.6 | |
| Medium | CVE-2026-55422 | conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard | 4.6 | |
| High | CVE-2025-32784 | conda-forge-webservices has an Unauthorized Artifact Modification Race Condition | — | |
| High | CVE-2025-35471 | conda-forge openssl-feedstock writable OPENSSLDIR | 7.3 | |
| Low | CVE-2025-49843 | conda-smithy Has Incorrect Default File Permissions | — | |
| Medium | CVE-2025-49598 | conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing | — | |
| Low | CVE-2025-49824 | conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack | — | |
| Low | CVE-2025-49842 | conda-forge-webservices Privilege Escalation Risk via Default Docker Root User | — |
Products
| Conda-smithy | 3 | 0 |