VY
Product
vyper
53
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 7High 15Medium 26Low 5
Watch
Add vyper to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-24563 | 9.8 | Feb 7 | Vyper array negative index vulnerability Affected: <= 0.3.10 |
| CVE-2024-24561 | 9.8 | Feb 1 | Vyper bounds check on built-in `slice()` function can be overflowed Affected: <= 0.3.10 |
| CVE-2024-22419 | 9.8 | Jan 18 | concat built-in can corrupt memory in vyper Affected: < 0.4.0 |
| CVE-2022-24845 | 9.8 | Apr 13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine Affected: before 0.3.2 |
| CVE-2022-24788 | 9.8 | Apr 13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine Affected: before 0.3.2 |
| CVE-2025-27105 | 9.1 | Feb 21 | AugAssign evaluation order causing OOB write within the object in Vyper Affected: < 0.4.1 |
| CVE-2023-31146 | 9.1 | May 11 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine Affected: before 0.3.8 |
| CVE-2021-41121 | 8.8 | Oct 6 | Vyper is a Pythonic Smart Contract Language for the EVM Affected: before 0.3.0 |
| CVE-2026-114663 | 8.4 | Oct 22 | Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments Affected: 0.4.0b1 through 0.5.0b1 |
| CVE-2023-42443 | 8.1 | Sep 18 | Vyper vulnerable to memory corruption in certain builtins utilizing `msize` Affected: <= 0.3.9 |
| CVE-2025-26622 | 7.5 | Feb 21 | sqrt doesn't define rounding behavior in Vyper Affected: < 0.4.1 |
| CVE-2025-27104 | 7.5 | Feb 21 | double eval in For List Iter in Vyper Affected: < 0.4.1 |
| CVE-2025-21607 | 7.5 | Jan 14 | Success of Certain Precompile Calls not Checked in Vyper Affected: < 0.4.1 |
| CVE-2023-46247 | 7.5 | Dec 13 | Vyper has incorrect storage layout for contracts containing large arrays Affected: < 0.3.8 |
| CVE-2023-42460 | 7.5 | Sep 26 | _abi_decode input not validated in complex expressions in Vyper Affected: >= 0.3.4, < 0.3.10 |
| CVE-2023-32059 | 7.5 | May 11 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine Affected: before 0.3.8 |
| CVE-2023-32058 | 7.5 | May 11 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine Affected: before 0.3.8 |
| CVE-2023-30837 | 7.5 | May 8 | Vyper is a pythonic smart contract language for the EVM Affected: before 0.3.8 |
| CVE-2023-30629 | 7.5 | Apr 24 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine Affected: 0.3.1 before 0.3.8 |
| CVE-2022-29255 | 7.5 | Jun 9 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine Affected: before 0.3.4 |
| CVE-2022-24787 | 7.5 | Apr 4 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine Affected: through 0.3.1 |
| CVE-2021-48018 | 7.4 | Oct 21 | Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator Affected: 0.2.13 before 0.2.15 |
| CVE-2021-48020 | 6.5 | Oct 21 | Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays Affected: 0.1.0b4 before 0.3.0 |
| CVE-2020-37286 | 6.5 | Oct 21 | Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls Affected: 0.1.0b4 before 0.3.0 |
| CVE-2026-114117 | 5.9 | Oct 21 | Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches Affected: 0.3.8 through 0.5.0b1 |
| CVE-2020-37287 | 5.9 | Oct 21 | Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments Affected: before 0.2.6 |
| CVE-2023-39363 | 5.9 | Aug 7 | Vyper incorrectly allocated named re-entrancy locks Affected: = 0.2.15; = 0.2.16; = 0.3.0 |
| CVE-2026-114116 | 5.3 | Oct 21 | Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators Affected: 0.1.0b1 before 0.1.0b17; 0.4.1 through 0.5.0b1 |
| CVE-2026-114114 | 5.3 | Oct 21 | Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters Affected: 0.1.0b1 before 0.1.0b12; 0.1.0b14 before 0.1.0b15; 0.4.1 through 0.5.0b1 |
| CVE-2024-32649 | 5.3 | Apr 25 | vyper performs double eval of the argument of sqrt Affected: <= 0.3.10 |
| CVE-2024-32648 | 5.3 | Apr 25 | vyper default functions don't respect nonreentrancy keys Affected: < 0.3.0 |
| CVE-2024-32647 | 5.3 | Apr 25 | vyper performs double eval of raw_args in create_from_blueprint Affected: <= 0.3.10 |
| CVE-2024-32646 | 5.3 | Apr 25 | vyper performs double eval of the slice args when buffer from adhoc locations Affected: <= 0.3.10 |
| CVE-2024-32645 | 5.3 | Apr 25 | vyper performs incorrect topic logging in raw_log Affected: <= 0.3.10 |
| CVE-2024-32481 | 5.3 | Apr 25 | vyper's range(start, start + N) reverts for negative numbers Affected: >= 0.3.8, < 0.4.0b1 |
| CVE-2024-24564 | 5.3 | Feb 26 | Vyper extract32 can ready dirty memory Affected: < 0.4.0 |
| CVE-2024-26149 | 5.3 | Feb 26 | Vyper _abi_decode Memory Overflow Affected: <= 0.3.10 |
| CVE-2024-24559 | 5.3 | Feb 5 | Vyper SHA3 code generation bug Affected: <= 0.3.10 |
| CVE-2024-24560 | 5.3 | Feb 2 | Vyper external calls can overflow return data to return input buffer Affected: <= 0.3.10 |
| CVE-2024-24567 | 5.3 | Jan 30 | raw_call `value=` kwargs not disabled for static and delegate calls Affected: <= 0.3.10 |
| CVE-2023-42441 | 5.3 | Sep 18 | Vyper has incorrect re-entrancy lock when key is empty string Affected: >= 0.2.9, < 0.3.10 |
| CVE-2023-40015 | 5.3 | Sep 4 | Vyper: reversed order of side effects for some operations Affected: <= 0.4.0 |
| CVE-2023-41052 | 5.3 | Sep 4 | Vyper: incorrect order of evaluation of side effects for some builtins Affected: <= 0.3.9 |
| CVE-2023-37902 | 5.3 | Jul 25 | Vyper's ecrecover can return undefined data if signature does not verify Affected: < 0.3.10 |
| CVE-2023-32675 | 5.3 | May 19 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine Affected: before 0.3.8 |
| CVE-2026-114118 | 4.8 | Oct 21 | Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound Affected: 0.3.4 through 0.5.0b1 |
| CVE-2021-48019 | 4.8 | Oct 21 | Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies Affected: before 0.2.9 |
| CVE-2021-41122 | 4.3 | Oct 5 | Vyper is a Pythonic Smart Contract Language for the EVM Affected: before 0.3.0 |
| CVE-2026-114115 | 3.7 | Oct 21 | Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection Affected: 0.3.8 through 0.5.0b1 |
| CVE-2020-37289 | 3.7 | Oct 21 | Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values Affected: before 0.3.1 |