What’s Vulnerable › Products
vyperlang vyper vulnerabilities
53 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Check whether your vyperlang vyper version is affected
Latest vyperlang vyper vulnerabilities
- CVE-2026-114663 — Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments (CVSS 8.4)
- CVE-2026-114118 — Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound (CVSS 4.8)
- CVE-2026-114117 — Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches (CVSS 5.9)
- CVE-2026-114115 — Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection (CVSS 3.7)
- CVE-2021-48019 — Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies (CVSS 4.8)
- CVE-2021-48018 — Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator (CVSS 7.4)
- CVE-2020-37288 — Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops (CVSS 3.7)
- CVE-2020-37286 — Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls (CVSS 6.5)
- CVE-2026-114116 — Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators (CVSS 5.3)
- CVE-2026-114114 — Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters (CVSS 5.3)
- CVE-2021-48020 — Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays (CVSS 6.5)
- CVE-2020-37289 — Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values (CVSS 3.7)
- CVE-2020-37287 — Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments (CVSS 5.9)
- CVE-2025-47774 — Vyper's `slice()` may elide side-effects when output length is 0 (CVSS 2.9)
- CVE-2025-47285 — Vyper's `concat()` builtin may elide side-effects for zero-length arguments (CVSS 2.9)
- CVE-2025-27105 — AugAssign evaluation order causing OOB write within the object in Vyper (CVSS 9.1)
- CVE-2025-27104 — double eval in For List Iter in Vyper (CVSS 7.5)
- CVE-2025-26622 — sqrt doesn't define rounding behavior in Vyper (CVSS 7.5)
- CVE-2025-21607 — Success of Certain Precompile Calls not Checked in Vyper (CVSS 7.5)
- CVE-2024-32649 — vyper performs double eval of the argument of sqrt (CVSS 5.3)
- CVE-2024-32648 — vyper default functions don't respect nonreentrancy keys (CVSS 5.3)
- CVE-2024-32647 — vyper performs double eval of raw_args in create_from_blueprint (CVSS 5.3)
- CVE-2024-32646 — vyper performs double eval of the slice args when buffer from adhoc locations (CVSS 5.3)
- CVE-2024-32645 — vyper performs incorrect topic logging in raw_log (CVSS 5.3)
- CVE-2024-32481 — vyper's range(start, start + N) reverts for negative numbers (CVSS 5.3)