OpenZeppelin openzeppelin-contracts vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20227
3. 20237
4. 20241
5. 20251

Newest CVEs

• CVE-2025-54070

  OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

  OpenZeppelin · openzeppelin-contracts

  Medium6.9
• CVE-2024-27094

  OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

  OpenZeppelin · openzeppelin-contracts

  Medium6.5
• CVE-2023-49798

  Duplicated execution of subcalls in OpenZeppelin Contracts

  OpenZeppelin · openzeppelin-contracts

  Medium5.9
• CVE-2023-40014

  OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

  OpenZeppelin · openzeppelin-contracts

  Medium5.3
• CVE-2023-34459

  OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

  OpenZeppelin · openzeppelin-contracts

  Medium5.3
• CVE-2023-34234

  Governor proposal creation may be blocked by frontrunning in OpenZeppelin

  OpenZeppelin · openzeppelin-contracts

  Medium5.3
• CVE-2023-30541

  TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

  OpenZeppelin · openzeppelin-contracts

  Medium5.3
• CVE-2023-30542

  GovernorCompatibilityBravo may trim proposal calldata

  OpenZeppelin · openzeppelin-contracts

  Medium6.8
• CVE-2023-26488

  OpenZeppelin Contracts contains Incorrect Calculation

  OpenZeppelin · openzeppelin-contracts

  Medium6.5
• CVE-2022-39384

  OpenZeppelin Contracts initializer reentrancy may lead to double initialization

  OpenZeppelin · openzeppelin-contracts

  Medium5.6