Vulnerabilities

TI-2026-41433 CVE-2026-57583

Improper output encoding in OpenZeppelin contracts-wizard

LOW 15

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00187 Published 2026-09-14 Fixed in 0.10.11, 3.0.1 +2 CWE-116

TI-2026-51729 CVE-2026-73645 · GHSA-hqf9-8xv5-x8xw

Integer overflow in openzeppelin-confidential-contracts

LOW 36

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00524 Published 2026-08-13 Fixed in 0.3.1 CWE-190

TI-2026-35496 CVE-2026-48054 · GHSA-4x76-22x2-rx8v

Code injection in OpenZeppelin contracts-wizard

MEDIUM 41

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00635 Published 2026-08-06 Fixed in 0.10.9 CWE-94

TI-2025-33913 CVE-2025-54070 · GHSA-9rcw-c2f9-2j55

Out-of-bounds read in openzeppelin-contracts

LOW 31

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00399 Published 2025-07-17 Fixed in 5.4.0 CWE-125

TI-2024-30375 CVE-2024-45304

OwnableTwoStep allows a pending owner to accept ownership after the original owner has…

LOW 29

Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00479 Published 2024-08-30 Fixed in 0.16.0 CWE-670

TI-2024-17955 CVE-2024-27094 · GHSA-9vx6-7xxf-x967

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

LOW 34

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00763 Published 2024-02-29 Fixed in 4.9.6, 5.0.2 CWE-125

TI-2023-27205 CVE-2023-49798 · GHSA-699g-q6qh-q4v8

Duplicated execution of subcalls in OpenZeppelin Contracts

LOW 34

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00543 Published 2023-12-08 Fixed in 4.9.5 CWE-670

TI-2023-20905 CVE-2023-40014 · GHSA-g4vp-m682-qqmp

OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

LOW 31

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00743 Published 2023-08-10 Fixed in 4.9.3 CWE-116

TI-2023-17284 CVE-2023-34459 · GHSA-wprv-93r4-jj2p

OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

LOW 27

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00371 Published 2023-06-16 Fixed in 4.9.2 CWE-354

TI-2023-17070 CVE-2023-34234 · GHSA-5h3x-9wvq-w4m2

Governor proposal creation may be blocked by frontrunning in OpenZeppelin

LOW 31

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00595 Published 2023-06-07 Fixed in 4.9.1 CWE-862

TI-2023-14376 CVE-2023-30541 · GHSA-mx2q-35m2-x2rh

TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

LOW 32

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00812 Published 2023-04-17 Fixed in 4.8.3 CWE-436

TI-2023-14377 CVE-2023-30542 · GHSA-93hq-5wgc-jc82

GovernorCompatibilityBravo may trim proposal calldata

LOW 39

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00584 Published 2023-04-16 Fixed in 4.8.3 CWE-20

TI-2023-11635 CVE-2023-26488 · GHSA-878m-3g6q-594q

OpenZeppelin Contracts contains Incorrect Calculation

LOW 30

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00713 Published 2023-03-03 Fixed in 4.8.2 CWE-682

TI-2023-09738 CVE-2023-23940 · GHSA-626q-v9j4-mcp4

OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass

LOW 28

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0022 Published 2023-02-03 Fixed in 0.6.1 CWE-345

TI-2022-18758 CVE-2022-39384 · GHSA-9c22-pwxw-p6hx

OpenZeppelin Contracts initializer reentrancy may lead to double initialization

LOW 26

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00661 Published 2022-11-04 Fixed in 4.4.1 CWE-665

TI-2022-16386 CVE-2022-35961 · GHSA-4h98-2769-gh6h

ECDSA signature malleability in OpenZeppelin Contracts

LOW 37

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 7.9 Network Low privileges User interaction EPSS 0.00453 Published 2022-08-14 Fixed in 4.7.3 CWE-354

TI-2022-16342 CVE-2022-35915 · GHSA-7grf-83vw-6f5x

Unbounded gas consumption in @openzeppelin/contracts

LOW 31

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00799 Published 2022-08-01 Fixed in 4.7.2 CWE-400

TI-2022-16343 CVE-2022-35916 · GHSA-9j3m-g383-29qr

Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

LOW 31

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00598 Published 2022-08-01 Fixed in 4.7.2 CWE-669

TI-2022-13238 CVE-2022-31198 · GHSA-xrc4-737v-9q75

GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

MEDIUM 40

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00788 Published 2022-08-01 Fixed in 4.7.2 CWE-682

TI-2022-13212 CVE-2022-31170 · GHSA-qh9x-gcfh-pcrw

OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

MEDIUM 40

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00788 Published 2022-07-21 Fixed in 4.7.1 CWE-20

TI-2022-13213 CVE-2022-31172 · GHSA-4g63-c64m-25w9

OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

LOW 39

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00503 Published 2022-07-21 Fixed in 4.7.1 CWE-20

TI-2022-13196 CVE-2022-31153 · GHSA-8mjr-jr5h-q2xr

OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

MEDIUM 62

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01455 Published 2022-07-15 Fixed in 0.2.1 CWE-664

TI-2021-21156 CVE-2021-46320 · GHSA-88g8-f5mf-f5rj

In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract…

LOW 35

In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01217 Published 2022-02-04 Fixed in 4.4.1 CWE-665

TI-2021-18096 CVE-2021-41264 · GHSA-5vp3-v4hc-gx76

UUPSUpgradeable vulnerability in OpenZeppelin Contracts

MEDIUM 45

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01487 Published 2021-11-12 Fixed in 4.3.2 CWE-665

TI-2021-16553 CVE-2021-39167 · GHSA-fg47-3c2x-m2wr

TimelockController vulnerability in OpenZeppelin Contracts

MEDIUM 46

OpenZepplin is a library for smart contract development.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0159 Published 2021-08-26 Fixed in 4.3.1, 3.4.2 +1 CWE-269

Vulnerabilities

Filters