CVE-2025-47774 | | | 2025-05-15 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side eff… |
CVE-2025-47285 | | | 2025-05-15 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side e… |
CVE-2025-27105 | Critical | 9.1 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. Ho… |
CVE-2025-27104 | High | 7.5 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the… |
CVE-2025-26622 | High | 7.5 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately… |
CVE-2025-21607 | High | 7.5 | 2025-01-14 | Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of t… |
CVE-2024-32649 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval… |
CVE-2024-32648 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and th… |
CVE-2024-32647 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can resul… |
CVE-2024-32646 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double ev… |
CVE-2024-32645 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` built… |
CVE-2024-32481 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `rang… |
CVE-2024-26149 | Low | 3.7 | 2024-02-26 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in… |
CVE-2024-24564 | Low | 3.7 | 2024-02-26 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has… |
CVE-2024-24563 | Critical | 9.8 | 2024-02-07 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned inte… |
CVE-2024-24559 | Low | 3.7 | 2024-02-05 | Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `heig… |
CVE-2024-24560 | Low | 3.7 | 2024-02-02 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at… |
CVE-2024-24561 | Critical | 9.8 | 2024-02-01 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for… |
CVE-2024-24567 | Medium | 4.8 | 2024-01-30 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a d… |
CVE-2024-22419 | High | 7.3 | 2024-01-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was all… |
CVE-2023-46247 | High | 7.5 | 2023-12-13 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots t… |
CVE-2023-42460 | Medium | 5.3 | 2023-09-27 | Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi… |
CVE-2023-42443 | High | 8.1 | 2023-09-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by th… |
CVE-2023-42441 | Medium | 5.3 | 2023-09-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@… |
CVE-2023-41052 | Low | 3.7 | 2023-09-04 | Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_… |
CVE-2023-40015 | Low | 3.7 | 2023-09-04 | Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right t… |
CVE-2023-39363 | Medium | 5.9 | 2023-08-07 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated… |
CVE-2023-37902 | Medium | 5.3 | 2023-07-25 | Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the o… |
CVE-2023-32675 | Low | 3.7 | 2023-05-19 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to se… |
CVE-2023-32059 | High | 7.5 | 2023-05-11 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorr… |
CVE-2023-32058 | High | 7.5 | 2023-05-11 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assi… |
CVE-2023-31146 | High | 7.5 | 2023-05-11 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written… |
CVE-2023-30837 | High | 7.5 | 2023-05-08 | Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attac… |
CVE-2023-30629 | High | 7.5 | 2023-04-24 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode… |
CVE-2022-29255 | High | 8.2 | 2022-06-09 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return val… |
CVE-2022-24845 | High | 8.8 | 2022-04-13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated t… |
CVE-2022-24788 | High | 7.1 | 2022-04-13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importin… |
CVE-2022-24787 | High | 7.5 | 2022-04-04 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting i… |
CVE-2021-41121 | High | 7.5 | 2021-10-06 | Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corrup… |
CVE-2021-41122 | Medium | 4.3 | 2021-10-05 | Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The… |