@openzeppelin openzeppelin-contracts

• CVE-2025-54070 Medium 6.9 OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers 0.4%
• CVE-2024-27094 Medium 6.5 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory 0.8%
• CVE-2023-49798 Medium 5.9 Duplicated execution of subcalls in OpenZeppelin Contracts 0.5%
• CVE-2023-40014 Medium 5.3 OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender 0.7%
• CVE-2023-34459 Medium 5.3 OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees 0.4%
• CVE-2023-34234 Medium 5.3 Governor proposal creation may be blocked by frontrunning in OpenZeppelin 0.6%
• CVE-2023-30541 Medium 5.3 TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts 0.8%
• CVE-2023-30542 Medium 6.8 GovernorCompatibilityBravo may trim proposal calldata 0.6%
• CVE-2023-26488 Medium 6.5 OpenZeppelin Contracts contains Incorrect Calculation 0.7%
• CVE-2022-39384 Medium 5.6 OpenZeppelin Contracts initializer reentrancy may lead to double initialization 0.7%
• CVE-2022-35961 High 7.9 ECDSA signature malleability in OpenZeppelin Contracts 0.5%
• CVE-2022-35915 Medium 5.3 Unbounded gas consumption in @openzeppelin/contracts 0.8%
• CVE-2022-35916 Medium 5.3 Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls 0.6%
• CVE-2022-31198 High 7.5 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts 0.8%
• CVE-2022-31170 High 7.5 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false 0.8%
• CVE-2022-31172 High 7.5 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers 0.5%
• CVE-2021-41264 Critical 9.8 UUPSUpgradeable vulnerability in OpenZeppelin Contracts 1.5%
• CVE-2021-39167 Critical 10.0 TimelockController vulnerability in OpenZeppelin Contracts 1.6%