# cve.now: Vyperlang

The newest entries naming Vyperlang as an affected vendor (up to 200), of 53 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114663](https://cve.now/CVE-2026-114663.md): Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments (CVSS 8.6)
- [CVE-2026-114118](https://cve.now/CVE-2026-114118.md): Vyper 0.3.4 through 0.5.0b1 create\_from\_blueprint Offset Validation Bypass via Unsigned Wraparound (CVSS 6.3)
- [CVE-2026-114117](https://cve.now/CVE-2026-114117.md): Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches (CVSS 8.2)
- [CVE-2026-114116](https://cve.now/CVE-2026-114116.md): Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators (CVSS 6.0)
- [CVE-2026-114115](https://cve.now/CVE-2026-114115.md): Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection (CVSS 6.3)
- [CVE-2026-114114](https://cve.now/CVE-2026-114114.md): Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters (CVSS 6.0)
- [CVE-2021-48020](https://cve.now/CVE-2021-48020.md): Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays (CVSS 8.3)
- [CVE-2021-48019](https://cve.now/CVE-2021-48019.md): Vyper before 0.2.9 Incorrect RETURNDATASIZE in create\_forwarder\_to Proxies (CVSS 6.3)
- [CVE-2021-48018](https://cve.now/CVE-2021-48018.md): Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator (CVSS 8.3)
- [CVE-2020-37289](https://cve.now/CVE-2020-37289.md): Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values (CVSS 6.3)
- [CVE-2020-37288](https://cve.now/CVE-2020-37288.md): Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops (CVSS 6.3)
- [CVE-2020-37287](https://cve.now/CVE-2020-37287.md): Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments (CVSS 8.2)
- [CVE-2020-37286](https://cve.now/CVE-2020-37286.md): Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls (CVSS 8.3)
- [CVE-2025-47774](https://cve.now/CVE-2025-47774.md): Vyper's \`slice()\` may elide side-effects when output length is 0 (CVSS 2.9)
- [CVE-2025-47285](https://cve.now/CVE-2025-47285.md): Vyper's \`concat()\` builtin may elide side-effects for zero-length arguments (CVSS 2.9)
- [CVE-2025-26622](https://cve.now/CVE-2025-26622.md): sqrt doesn't define rounding behavior in Vyper (CVSS 2.3)
- [CVE-2025-27104](https://cve.now/CVE-2025-27104.md): double eval in For List Iter in Vyper (CVSS 2.3)
- [CVE-2025-27105](https://cve.now/CVE-2025-27105.md): AugAssign evaluation order causing OOB write within the object in Vyper (CVSS 2.3)
- [CVE-2025-21607](https://cve.now/CVE-2025-21607.md): Success of Certain Precompile Calls not Checked in Vyper (CVSS 2.3)
- [CVE-2024-32649](https://cve.now/CVE-2024-32649.md): vyper performs double eval of the argument of sqrt (CVSS 5.3)
- [CVE-2024-32648](https://cve.now/CVE-2024-32648.md): vyper default functions don't respect nonreentrancy keys (CVSS 5.3)
- [CVE-2024-32647](https://cve.now/CVE-2024-32647.md): vyper performs double eval of raw\_args in create\_from\_blueprint (CVSS 5.3)
- [CVE-2024-32646](https://cve.now/CVE-2024-32646.md): vyper performs double eval of the slice args when buffer from adhoc locations (CVSS 5.3)
- [CVE-2024-32645](https://cve.now/CVE-2024-32645.md): vyper performs incorrect topic logging in raw\_log (CVSS 5.3)
- [CVE-2024-32481](https://cve.now/CVE-2024-32481.md): vyper's range(start, start + N) reverts for negative numbers (CVSS 5.3)
- [CVE-2024-24564](https://cve.now/CVE-2024-24564.md): Vyper extract32 can ready dirty memory (CVSS 3.7)
- [CVE-2024-26149](https://cve.now/CVE-2024-26149.md): Vyper \_abi\_decode Memory Overflow (CVSS 3.7)
- [CVE-2024-24563](https://cve.now/CVE-2024-24563.md): Vyper array negative index vulnerability (CVSS 9.8)
- [CVE-2024-24559](https://cve.now/CVE-2024-24559.md): Vyper SHA3 code generation bug (CVSS 3.7)
- [CVE-2024-24560](https://cve.now/CVE-2024-24560.md): Vyper external calls can overflow return data to return input buffer (CVSS 3.7)
- [CVE-2024-24561](https://cve.now/CVE-2024-24561.md): Vyper bounds check on built-in \`slice()\` function can be overflowed (CVSS 9.8)
- [CVE-2024-24567](https://cve.now/CVE-2024-24567.md): raw\_call \`value=\` kwargs not disabled for static and delegate calls (CVSS 4.8)
- [CVE-2024-22419](https://cve.now/CVE-2024-22419.md): concat built-in can corrupt memory in vyper (CVSS 7.3)
- [CVE-2023-46247](https://cve.now/CVE-2023-46247.md): Vyper has incorrect storage layout for contracts containing large arrays (CVSS 7.5)
- [CVE-2023-42460](https://cve.now/CVE-2023-42460.md): \_abi\_decode input not validated in complex expressions in Vyper (CVSS 5.3)
- [CVE-2023-42443](https://cve.now/CVE-2023-42443.md): Vyper vulnerable to memory corruption in certain builtins utilizing \`msize\` (CVSS 8.1)
- [CVE-2023-42441](https://cve.now/CVE-2023-42441.md): Vyper has incorrect re-entrancy lock when key is empty string (CVSS 5.3)
- [CVE-2023-40015](https://cve.now/CVE-2023-40015.md): Vyper: reversed order of side effects for some operations (CVSS 3.7)
- [CVE-2023-41052](https://cve.now/CVE-2023-41052.md): Vyper: incorrect order of evaluation of side effects for some builtins (CVSS 3.7)
- [CVE-2023-39363](https://cve.now/CVE-2023-39363.md): Vyper incorrectly allocated named re-entrancy locks (CVSS 9.1)
- [CVE-2023-37902](https://cve.now/CVE-2023-37902.md): Vyper's ecrecover can return undefined data if signature does not verify (CVSS 5.3)
- [CVE-2023-32675](https://cve.now/CVE-2023-32675.md): Nonpayable default functions are sometimes payable in vyper (CVSS 3.7)
- [CVE-2023-32059](https://cve.now/CVE-2023-32059.md): Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls (CVSS 7.5)
- [CVE-2023-32058](https://cve.now/CVE-2023-32058.md): Vyper vulnerable to integer overflow in loop (CVSS 7.5)
- [CVE-2023-31146](https://cve.now/CVE-2023-31146.md): Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment (CVSS 7.5)
- [CVE-2023-30837](https://cve.now/CVE-2023-30837.md): Vyper storage allocator overflow (CVSS 7.5)
- [CVE-2023-30629](https://cve.now/CVE-2023-30629.md): Vyper's raw\_call with outsize=0 and revert\_on\_failure=False returns incorrect success value (CVSS 7.5)
- [CVE-2022-29255](https://cve.now/CVE-2022-29255.md): Multiple evaluation of contract address in call in vyper (CVSS 8.2)
- [CVE-2022-24845](https://cve.now/CVE-2022-24845.md): Integer bounds error in Vyper (CVSS 8.8)
- [CVE-2022-24788](https://cve.now/CVE-2022-24788.md): Buffer overflow in Vyper (CVSS 7.1)
- [CVE-2022-24787](https://cve.now/CVE-2022-24787.md): Incorrect Comparison in Vyper (CVSS 7.5)
- [CVE-2021-41121](https://cve.now/CVE-2021-41121.md): Memory corruption in Vyper (CVSS 7.5)
- [CVE-2021-41122](https://cve.now/CVE-2021-41122.md): Bounds check missing for decimal args in Vyper (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/vyperlang
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.