Log in Start free

@openzeppelin

Products

ProductCVEsExploitedLatest
openzeppelin-contracts18–Jul 17, 2025
cairo-contracts3–Aug 30, 2024
contracts-wizard2–Sep 14, 2026
wizard1–Sep 14, 2026
wizard-cairo1–Sep 14, 2026
wizard-stellar1–Sep 14, 2026
wizard-stylus1–Sep 14, 2026
openzeppelin-confidential-contracts1–Aug 13, 2026
openzeppelin-contracts-upgradeable1–Aug 26, 2021

Exploited and recent CVEs

  • CVE-2026-57583 Low 3.3 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source 0.2%
  • CVE-2026-57583 Low 3.3 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source 0.2%
  • CVE-2026-57583 Low 3.3 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source 0.2%
  • CVE-2026-57583 Low 3.3 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source 0.2%
  • CVE-2026-57583 Low 3.3 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source 0.2%
  • CVE-2026-73645 Medium 6.6 OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds. 0.5%
  • CVE-2026-48054 High 8.8 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri 0.6%
  • CVE-2025-54070 Medium 6.9 OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers 0.4%
  • CVE-2024-45304 Medium 5.3 OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts 0.5%
  • CVE-2024-27094 Medium 6.5 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory 0.8%
  • CVE-2023-49798 Medium 5.9 Duplicated execution of subcalls in OpenZeppelin Contracts 0.5%
  • CVE-2023-40014 Medium 5.3 OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender 0.7%
  • CVE-2023-34459 Medium 5.3 OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees 0.4%
  • CVE-2023-34234 Medium 5.3 Governor proposal creation may be blocked by frontrunning in OpenZeppelin 0.6%
  • CVE-2023-30541 Medium 5.3 TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts 0.8%
  • CVE-2023-30542 Medium 6.8 GovernorCompatibilityBravo may trim proposal calldata 0.6%
  • CVE-2023-26488 Medium 6.5 OpenZeppelin Contracts contains Incorrect Calculation 0.7%
  • CVE-2023-23940 Medium 6.4 OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass 0.2%
  • CVE-2022-39384 Medium 5.6 OpenZeppelin Contracts initializer reentrancy may lead to double initialization 0.7%
  • CVE-2022-35961 High 7.9 ECDSA signature malleability in OpenZeppelin Contracts 0.5%
  • CVE-2022-35915 Medium 5.3 Unbounded gas consumption in @openzeppelin/contracts 0.8%
  • CVE-2022-35916 Medium 5.3 Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls 0.6%
  • CVE-2022-31198 High 7.5 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts 0.8%
  • CVE-2022-31170 High 7.5 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false 0.8%
  • CVE-2022-31172 High 7.5 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers 0.5%
  • CVE-2022-31153 Medium 6.5 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli 1.5%
  • CVE-2021-41264 Critical 9.8 UUPSUpgradeable vulnerability in OpenZeppelin Contracts 1.5%
  • CVE-2021-39167 Critical 10.0 TimelockController vulnerability in OpenZeppelin Contracts 1.6%
  • CVE-2021-39168 Critical 10.0 TimelockController vulnerability in OpenZeppelin Contracts 1.6%