Technology · Vyper
Vyper vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 19 vulnerabilities in Vyper: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114663, was published on 22 October 2026. 10 vulnerabilities in the last four weeks, up 233% on the four before (3).
- Last 7 days
- 0
- Last 90 days
- 13
- Critical, all time
- 0
- Exploited in the wild
- 0
About Vyper
Pythonic smart contract programming language designed for the Ethereum Virtual Machine.
Latest Vyper vulnerabilities
- CVE-2026-114663: Vyper name resolution scope vulnerability in constants and defaultshighCVSS 8.4
- CVE-2026-114118: Vyper create_from_blueprint offset validation bypass via unsigned wraparoundmediumCVSS 4.8
- CVE-2026-114117: Vyper optimizer miscompilation in ternary expressionsmediumCVSS 5.9
- CVE-2026-114116: Vyper source-line table parsing allows numeric literal value manipulationmediumCVSS 5.3
- CVE-2026-114114: Vyper source literal value substitution via multi-byte charactersmediumCVSS 5.3
- CVE-2021-48020: Vyper memory corruption in internal function calls within arraysmediumCVSS 6.5
- CVE-2021-48019: Vyper create_forwarder_to incorrect RETURNDATASIZE in proxiesmediumCVSS 4.8
- CVE-2021-48018: Vyper storage variable corruption via @nonreentrant decoratorhighCVSS 7.4
- CVE-2020-37287: Vyper call stack corruption with complex type argumentsmediumCVSS 5.9
- CVE-2020-37286: Vyper memory corruption in nested internal function callsmediumCVSS 6.5
- Vyper memory corruption in nested function calls and tuplesmedium
- Vyper stack corruption in complex type argument passingmedium
- Vyper return statement in nested for loops causes revertmedium
- CVE-2024-22419: Vyper concat built-in memory corruptionlowCVSS 3.1EPSS 0.8%
- CVE-2023-42441: Vyper reentrancy lock bypass with empty string keylowCVSS 3.1EPSS 0.5%
- CVE-2023-41052: Vyper incorrect order of evaluation of side effects in builtinsmediumCVSS 5.3EPSS 0.5%
- CVE-2023-31146: Vyper out-of-bounds DynArray access in assignment codegenlowCVSS 3.1EPSS 1.2%
- Vyper memory corruption in function calls within arraysinfo
- Vyper incorrect returndatasize in pre-EIP-1167 forwarder proxiesinfoCVSS 3.7
Most severe Vyper vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-114663: Vyper name resolution scope vulnerability in constants and defaultshighCVSS 8.4
- CVE-2021-48018: Vyper storage variable corruption via @nonreentrant decoratorhighCVSS 7.4
- CVE-2021-48020: Vyper memory corruption in internal function calls within arraysmediumCVSS 6.5
- CVE-2020-37286: Vyper memory corruption in nested internal function callsmediumCVSS 6.5
- CVE-2026-114117: Vyper optimizer miscompilation in ternary expressionsmediumCVSS 5.9
- CVE-2020-37287: Vyper call stack corruption with complex type argumentsmediumCVSS 5.9
- CVE-2023-41052: Vyper incorrect order of evaluation of side effects in builtinsmediumCVSS 5.3EPSS 0.5%
- CVE-2026-114116: Vyper source-line table parsing allows numeric literal value manipulationmediumCVSS 5.3
- CVE-2026-114114: Vyper source literal value substitution via multi-byte charactersmediumCVSS 5.3
- CVE-2026-114118: Vyper create_from_blueprint offset validation bypass via unsigned wraparoundmediumCVSS 4.8
Vulnerabilities per week
10 vulnerabilities in the last four weeks, up 233% on the four before (3). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 3 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 10 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Vyper vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/vyper-vyper)<a href="https://junglewise.ai/threats/technologies/vyper-vyper"><img src="https://junglewise.ai/threats/technologies/vyper-vyper/badge.svg" alt="Vyper vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/vyper-vyper.json, and this page as text at https://junglewise.ai/threats/technologies/vyper-vyper.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Vyper vulnerabilities", https://junglewise.ai/threats/technologies/vyper-vyper, 9 November 2026.