Conda Forge is a community-driven repository and build infrastructure that packages open-source software for distribution across multiple platforms and Python environments, with its vulnerability surface primarily reflecting inherited exposures from upstream dependencies such as OpenSSL rather than flaws native to the packaging system itself. The observed disclosures cluster around tools and feedstocks used to manage and distribute those dependencies, such as Miniforge, underscoring the vendor's role as a distribution and supply-chain intermediary rather than a primary software developer. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Conda Forge over time
Signals from CVEs in this vendor scope (1 CVEs).
1 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-35471HIGH conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local use | May 13, 2025 | 7.8 | 22 | NO | NO |
Signals from CVEs in this vendor scope (1 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Conda Forge.
Media articles that mention a CVE ID that affects a product developed by Conda Forge — matched by CVE ID, not by vendor name.