CO
Vendor
conda-forge
11
CVEs
0
On KEV
1
New 30D
Products
CO4.6
conda-forge.github.io
conda-forge
1 CVEs0 on KEV1 new
CO7.6
conda-smithy
conda-forge
3 CVEs0 on KEV0 new
CO7.5
conda-forge-webservices
conda-forge
2 CVEs0 on KEV0 new
CO4.4
conda-forge-ci-setup-feedstock
conda-forge
1 CVEs0 on KEV0 new
CO9.3
conda-forge-metadata
conda-forge
1 CVEs0 on KEV0 new
IN9.3
infrastructure
conda-forge
1 CVEs0 on KEV0 new
MI7.8
miniforge
conda-forge
1 CVEs0 on KEV0 new
OP7.8
openssl-feedstock
conda-forge
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-55422 New | CO conda-forge.github.io conda-forge | 4.6 | Oct 23 | conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard |
| CVE-2026-46699 | CO conda-smithy conda-forge | 7.6 | Jun 18 | conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository |
| CVE-2025-49824 | CO conda-smithy conda-forge | 1.7 | Jun 17 | conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack |
| CVE-2025-49843 | CO conda-smithy conda-forge | 2.7 | Jun 17 | conda-smithy Has Incorrect Default File Permissions |
| CVE-2025-49842 | CO conda-forge-webservices conda-forge | 1.0 | Jun 17 | conda-forge-webservices Privilege Escalation Risk via Default Docker Root User |
| CVE-2025-49598 | CO conda-forge-ci-setup-feedstock conda-forge | 4.4 | Jun 13 | conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing |
| CVE-2025-35471 | MI miniforge conda-forge | 7.8 | May 13 | conda-forge openssl-feedstock writable OPENSSLDIR |
| CVE-2025-32784 | CO conda-forge-webservices conda-forge | 7.5 | Apr 15 | conda-forge-webservices has an Unauthorized Artifact Modification Race Condition |
| CVE-2025-31484 | IN infrastructure conda-forge | 9.3 | Apr 2 | conda-forge infrastructure uses a bad token for Azure's cf-staging access |
| CVE-2025-27510 | CO conda-forge-metadata conda-forge | 9.3 | Mar 4 | RCE in the package conda-forge-metadata |