What’s Vulnerable › Products

OpenZeppelin Contracts Upgradeable vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 0 published in the last 12 months.

Check whether your OpenZeppelin Contracts Upgradeable version is affected

Latest OpenZeppelin Contracts Upgradeable vulnerabilities

• CVE-2024-27094 — OpenZeppelin Contracts base64 encoding may read from potentially dirty memory (CVSS 7.4)
• CVE-2023-49798 — Duplicated execution of subcalls in OpenZeppelin Contracts (CVSS 7.5)
• CVE-2023-34459 — OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees (CVSS 5.9)
• CVE-2023-34234 — Governor proposal creation may be blocked by frontrunning in OpenZeppelin (CVSS 5.3)
• CVE-2023-30541 — TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts (CVSS 5.3)
• CVE-2023-30542 — GovernorCompatibilityBravo may trim proposal calldata (CVSS 8.8)
• CVE-2023-26488 — OpenZeppelin Contracts contains Incorrect Calculation (CVSS 6.5)
• CVE-2022-39384 — OpenZeppelin Contracts initializer reentrancy may lead to double initialization (CVSS 5.6)
• CVE-2022-35961 — ECDSA signature malleability in OpenZeppelin Contracts (CVSS 6.5)
• CVE-2022-35916 — Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls (CVSS 5.3)
• CVE-2022-35915 — Unbounded gas consumption in @openzeppelin/contracts (CVSS 5.3)
• CVE-2022-31198 — GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts (CVSS 7.5)