[ Vendor · 13 CVEs ]
vyperlang
CVEs affecting vyperlang published in the last 30 days, plus any vyperlang CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114663 | 22 Oct 2026 | CVSS 8.4 | vyperlang vyperVyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their… | |
| CVE-2026-114117 | 21 Oct 2026 | CVSS 5.9 | vyperlang vyperVyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer… | |
| CVE-2026-114118 | 21 Oct 2026 | CVSS 4.8 | vyperlang vyperVyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that… | |
| CVE-2026-114114 | 21 Oct 2026 | CVSS 5.3 | vyperlang vyperVyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in… | |
| CVE-2026-114115 | 21 Oct 2026 | CVSS 3.7 | vyperlang vyperVyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using… | |
| CVE-2026-114116 | 21 Oct 2026 | CVSS 5.3 | vyperlang vyperVyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed… | |
| CVE-2021-48019 | 21 Oct 2026 | CVSS 4.8 | vyperlang vyperVyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather… | |
| CVE-2021-48020 | 21 Oct 2026 | CVSS 6.5 | vyperlang vyperVyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are… | |
| CVE-2020-37286 | 21 Oct 2026 | CVSS 6.5 | vyperlang vyperVyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls… | |
| CVE-2020-37287 | 21 Oct 2026 | CVSS 5.9 | vyperlang vyperVyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are… | |
| CVE-2020-37288 | 21 Oct 2026 | CVSS 3.7 | vyperlang vyperVyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more… | |
| CVE-2020-37289 | 21 Oct 2026 | CVSS 3.7 | vyperlang vyperVyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256… | |
| CVE-2021-48018 | 21 Oct 2026 | CVSS 7.4 | vyperlang vyperVyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When… |