What’s Vulnerable › Products
openzeppelin-contracts vulnerabilities
21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.
Check whether your openzeppelin-contracts version is affected
Latest openzeppelin-contracts vulnerabilities
- CVE-2025-54070 — OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers (CVSS 6.9)
- CVE-2024-45304 — OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts (CVSS 6.5)
- CVE-2024-27094 — OpenZeppelin Contracts base64 encoding may read from potentially dirty memory (CVSS 7.4)
- CVE-2023-49798 — Duplicated execution of subcalls in OpenZeppelin Contracts (CVSS 7.5)
- CVE-2023-34459 — OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees (CVSS 5.9)
- CVE-2023-34234 — Governor proposal creation may be blocked by frontrunning in OpenZeppelin (CVSS 5.3)
- CVE-2023-30541 — TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts (CVSS 5.3)
- CVE-2023-30542 — GovernorCompatibilityBravo may trim proposal calldata (CVSS 8.8)
- CVE-2023-26488 — OpenZeppelin Contracts contains Incorrect Calculation (CVSS 6.5)
- CVE-2023-23940 — OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass (CVSS 5.3)
- CVE-2022-39384 — OpenZeppelin Contracts initializer reentrancy may lead to double initialization (CVSS 5.6)
- CVE-2022-35961 — ECDSA signature malleability in OpenZeppelin Contracts (CVSS 6.5)
- CVE-2022-35916 — Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls (CVSS 5.3)
- CVE-2022-35915 — Unbounded gas consumption in @openzeppelin/contracts (CVSS 5.3)
- CVE-2022-31198 — GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts (CVSS 7.5)
- CVE-2022-31172 — OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers (CVSS 7.5)
- CVE-2022-31170 — OpenZeppelin Contracts's ERC165Checker may revert instead of returning false (CVSS 7.5)
- CVE-2022-31153 — OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli (CVSS 6.5)
- CVE-2021-41264 — UUPSUpgradeable vulnerability in OpenZeppelin Contracts (CVSS 7.5)
- CVE-2021-39168 — TimelockController vulnerability in OpenZeppelin Contracts (CVSS 9.8)
- CVE-2021-39167 — TimelockController vulnerability in OpenZeppelin Contracts (CVSS 9.8)