https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-23528.htmlhttps://patchthecve.com/cve/CVE-2026-23528.htmlWed, 17 Jun 2026 10:21:43 +0000MEDIUM 6.1: Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting (XSS) bug in the Dask dashbhttps://patchthecve.com/cve/CVE-2024-46060.htmlhttps://patchthecve.com/cve/CVE-2024-46060.htmlSat, 26 Sep 2026 21:10:00 +0000HIGH 7.8: Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This allows a local low-privileged user to inject arbitrary commanhttps://patchthecve.com/cve/CVE-2025-32800.htmlhttps://patchthecve.com/cve/CVE-2025-32800.htmlWed, 17 Jun 2026 09:12:35 +0000CRITICAL 9.8: Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit https://patchthecve.com/cve/CVE-2025-32799.htmlhttps://patchthecve.com/cve/CVE-2025-32799.htmlWed, 17 Jun 2026 09:12:35 +0000CRITICAL 9.8: Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tarslip) attacks due to improper sanitization of tar entry paths. Attackers can craft tar archives containing entries with directory traversal shttps://patchthecve.com/cve/CVE-2025-32798.htmlhttps://patchthecve.com/cve/CVE-2025-32798.htmlWed, 17 Jun 2026 09:12:35 +0000CRITICAL 9.8: Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process embeddehttps://patchthecve.com/cve/CVE-2025-32797.htmlhttps://patchthecve.com/cve/CVE-2025-32797.htmlWed, 17 Jun 2026 09:12:35 +0000HIGH 7.0: Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access to all users. Attackers with filesystem a