OpenZeppelin openzeppelin-contracts vulnerabilities

18 published CVEs name OpenZeppelin openzeppelin-contracts among the affected products.

Newest CVEs

CVE-2025-54070
OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
OpenZeppelin · openzeppelin-contracts
Medium6.9
CVE-2024-27094
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
OpenZeppelin · openzeppelin-contracts
Medium6.5
CVE-2023-49798
Duplicated execution of subcalls in OpenZeppelin Contracts
OpenZeppelin · openzeppelin-contracts
Medium5.9
CVE-2023-40014
OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender
OpenZeppelin · openzeppelin-contracts
Medium5.3
CVE-2023-34459
OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
OpenZeppelin · openzeppelin-contracts
Medium5.3
CVE-2023-34234
Governor proposal creation may be blocked by frontrunning in OpenZeppelin
OpenZeppelin · openzeppelin-contracts
Medium5.3
CVE-2023-30541
TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts
OpenZeppelin · openzeppelin-contracts
Medium5.3
CVE-2023-30542
GovernorCompatibilityBravo may trim proposal calldata
OpenZeppelin · openzeppelin-contracts
Medium6.8
CVE-2023-26488
OpenZeppelin Contracts contains Incorrect Calculation
OpenZeppelin · openzeppelin-contracts
Medium6.5
CVE-2022-39384
OpenZeppelin Contracts initializer reentrancy may lead to double initialization
OpenZeppelin · openzeppelin-contracts
Medium5.6