VY
Product
vyper
53
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 7High 15Medium 26Low 5
Watch
Add vyper to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-48020 | 6.5 | Oct 21 | Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays Affected: 0.1.0b4 before 0.3.0 |
| CVE-2020-37286 | 6.5 | Oct 21 | Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls Affected: 0.1.0b4 before 0.3.0 |
| CVE-2026-114117 | 5.9 | Oct 21 | Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches Affected: 0.3.8 through 0.5.0b1 |
| CVE-2020-37287 | 5.9 | Oct 21 | Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments Affected: before 0.2.6 |
| CVE-2023-39363 | 5.9 | Aug 7 | Vyper incorrectly allocated named re-entrancy locks Affected: = 0.2.15; = 0.2.16; = 0.3.0 |
| CVE-2026-114116 | 5.3 | Oct 21 | Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators Affected: 0.1.0b1 before 0.1.0b17; 0.4.1 through 0.5.0b1 |
| CVE-2026-114114 | 5.3 | Oct 21 | Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters Affected: 0.1.0b1 before 0.1.0b12; 0.1.0b14 before 0.1.0b15; 0.4.1 through 0.5.0b1 |
| CVE-2024-32649 | 5.3 | Apr 25 | vyper performs double eval of the argument of sqrt Affected: <= 0.3.10 |
| CVE-2024-32648 | 5.3 | Apr 25 | vyper default functions don't respect nonreentrancy keys Affected: < 0.3.0 |
| CVE-2024-32647 | 5.3 | Apr 25 | vyper performs double eval of raw_args in create_from_blueprint Affected: <= 0.3.10 |
| CVE-2024-32646 | 5.3 | Apr 25 | vyper performs double eval of the slice args when buffer from adhoc locations Affected: <= 0.3.10 |
| CVE-2024-32645 | 5.3 | Apr 25 | vyper performs incorrect topic logging in raw_log Affected: <= 0.3.10 |
| CVE-2024-32481 | 5.3 | Apr 25 | vyper's range(start, start + N) reverts for negative numbers Affected: >= 0.3.8, < 0.4.0b1 |
| CVE-2024-24564 | 5.3 | Feb 26 | Vyper extract32 can ready dirty memory Affected: < 0.4.0 |
| CVE-2024-26149 | 5.3 | Feb 26 | Vyper _abi_decode Memory Overflow Affected: <= 0.3.10 |
| CVE-2024-24559 | 5.3 | Feb 5 | Vyper SHA3 code generation bug Affected: <= 0.3.10 |
| CVE-2024-24560 | 5.3 | Feb 2 | Vyper external calls can overflow return data to return input buffer Affected: <= 0.3.10 |
| CVE-2024-24567 | 5.3 | Jan 30 | raw_call `value=` kwargs not disabled for static and delegate calls Affected: <= 0.3.10 |
| CVE-2023-42441 | 5.3 | Sep 18 | Vyper has incorrect re-entrancy lock when key is empty string Affected: >= 0.2.9, < 0.3.10 |
| CVE-2023-40015 | 5.3 | Sep 4 | Vyper: reversed order of side effects for some operations Affected: <= 0.4.0 |
| CVE-2023-41052 | 5.3 | Sep 4 | Vyper: incorrect order of evaluation of side effects for some builtins Affected: <= 0.3.9 |
| CVE-2023-37902 | 5.3 | Jul 25 | Vyper's ecrecover can return undefined data if signature does not verify Affected: < 0.3.10 |
| CVE-2023-32675 | 5.3 | May 19 | Nonpayable default functions are sometimes payable in vyper Affected: < 0.3.8 |
| CVE-2026-114118 | 4.8 | Oct 21 | Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound Affected: 0.3.4 through 0.5.0b1 |
| CVE-2021-48019 | 4.8 | Oct 21 | Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies Affected: before 0.2.9 |
| CVE-2021-41122 | 4.3 | Oct 5 | Vyper is a Pythonic Smart Contract Language for the EVM Affected: before 0.3.0 |
Showing 26