Vulnerabilities

TI-2026-18952 CVE-2026-23528 · GHSA-c336-7962-wfj2

Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

LOW 24

Dask distributed is a distributed task scheduler for Dask.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00235 Published 2026-01-16 Fixed in 2026.1.0 CWE-250

TI-2024-30876 CVE-2024-46060 · GHSA-q9rq-fh6c-82mw

Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation…

LOW 35

Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.002 Published 2025-12-17 No fix listed CWE-732

TI-2025-23837 CVE-2025-32800

Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI

LOW 35

Conda-build contains commands and tools to build conda packages.

CVSS 4.0HIGH 7.2 Network No auth No interaction EPSS 0.00646 Published 2025-06-16 Fixed in 25.3.0 CWE-1357

TI-2025-23836 CVE-2025-32799

Conda-build Vulnerable to Path Traversal via Malicious Tar File

MEDIUM 58

Conda-build contains commands and tools to build conda packages.

CVSS 4.0MEDIUM 5.6 Network No auth User interaction EPSS 0.0133 Published 2025-06-16 Fixed in 25.4.0 CWE-22

TI-2025-23835 CVE-2025-32798

Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors

HIGH 71

Conda-build contains commands and tools to build conda packages.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00831 Published 2025-06-16 Fixed in 25.4.0 CWE-94

TI-2025-23834 CVE-2025-32797

Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution

LOW 26

Conda-build contains commands and tools to build conda packages.

CVSS 4.0MEDIUM 6.0 Local No auth No interaction EPSS 0.00172 Published 2025-06-16 Fixed in 25.3.1 CWE-277

TI-2023-17920 CVE-2023-35845 · GHSA-hhfv-2xc3-52h6

Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by…

MEDIUM 55

Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00121 Published 2023-09-11 No fix listed CWE-295

TI-2021-19057 CVE-2021-42969 · GHSA-p9v4-8gqg-fmcp

Certain Anaconda3 2021.05 are affected by OS command injection.

MEDIUM 42

Certain Anaconda3 2021.05 are affected by OS command injection.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01909 Published 2022-05-13 No fix listed CWE-78

TI-2022-09864 CVE-2022-26526 · GHSA-4qx4-v2q7-m2gp

Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through…

LOW 34

Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0033 Published 2022-03-17 No fix listed CWE-732

TI-2021-18772 CVE-2021-42343 · GHSA-hwqr-f3v9-hwxr

An issue was discovered in the Dask distributed package before 2021.10.0 for Python.

MEDIUM 47

An issue was discovered in the Dask distributed package before 2021.10.0 for Python.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02982 Published 2021-10-26 Fixed in 2021.10.0 CWE-668

Vulnerabilities

Filters