Conda-Forge
8 CVEs across 7 Conda-Forge products. Browse Conda-Forge vulnerabilities, severities, and proof-of-concept exploits.
Conda-Forge products with known CVEs
Conda-Forge CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-46699 | High | 7.6 | 2026-06-18 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.6… |
CVE-2025-49843 | | | 2025-06-17 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.4… |
CVE-2025-49824 | | | 2025-06-17 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.4… |
CVE-2025-49842 | | | 2025-06-17 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker co… |
CVE-2025-49598 | | | 2025-06-13 | conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to… |
CVE-2025-35471 | High | 7.3 | 2025-05-13 | conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by no… |
CVE-2025-32784 | | | 2025-04-15 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability h… |
CVE-2025-31484 | | | 2025-04-02 | conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure.
Between 2025-02-10 and 2025-04-01, conda-… |
CVE-2025-27510 | | | 2025-03-04 | conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was nei… |