OpenZeppelin Contracts Upgradeable any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

11CVEs

GovernorCompatibilityBravo may trim proposal calldata

Published 2023-04-16 · Modified

8.8EPSS 0.006

ECDSA signature malleability in OpenZeppelin Contracts

Published 2022-08-14 · Modified

7.9EPSS 0.004

GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

Published 2022-08-01 · Modified

7.5EPSS 0.007

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

Published 2024-02-29 · Analyzed

7.4EPSS 0.008

OpenZeppelin Contracts contains Incorrect Calculation

Published 2023-03-03 · Modified

6.5EPSS 0.007

OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

Published 2023-06-16 · Modified

5.9EPSS 0.004

OpenZeppelin Contracts initializer reentrancy may lead to double initialization

Published 2022-11-04 · Modified

5.6EPSS 0.005

TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

Published 2023-04-17 · Modified

5.3EPSS 0.008

Unbounded gas consumption in @openzeppelin/contracts

Published 2022-08-01 · Modified

5.3EPSS 0.008

Governor proposal creation may be blocked by frontrunning in OpenZeppelin

Published 2023-06-07 · Modified

5.3EPSS 0.006

Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

Published 2022-08-01 · Modified

5.3EPSS 0.006