OpenZeppelin vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20228
3. 20238
4. 20242
5. 20251
6. 20263

Newest CVEs

• CVE-2026-57583

  OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

  OpenZeppelin · contracts-wizard

  Low3.3
• CVE-2026-73645

  OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.

  OpenZeppelin · openzeppelin-confidential-contracts

  Medium6.6
• CVE-2026-48054

  OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

  OpenZeppelin · contracts-wizard

  High8.8
• CVE-2025-54070

  OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

  OpenZeppelin · openzeppelin-contracts

  Medium6.9
• CVE-2024-45304

  OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts

  OpenZeppelin · cairo-contracts

  Medium5.3
• CVE-2024-27094

  OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

  OpenZeppelin · openzeppelin-contracts

  Medium6.5
• CVE-2023-49798

  Duplicated execution of subcalls in OpenZeppelin Contracts

  OpenZeppelin · openzeppelin-contracts

  Medium5.9
• CVE-2023-40014

  OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

  OpenZeppelin · openzeppelin-contracts

  Medium5.3
• CVE-2023-34459

  OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

  OpenZeppelin · openzeppelin-contracts

  Medium5.3
• CVE-2023-34234

  Governor proposal creation may be blocked by frontrunning in OpenZeppelin

  OpenZeppelin · openzeppelin-contracts

  Medium5.3