{"schema_version":1,"title":"Vyper vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in Vyper: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114663, was published on 22 October 2026. 10 vulnerabilities in the last four weeks, up 233% on the four before (3).","url":"https://junglewise.ai/threats/technologies/vyper-vyper","json_url":"https://junglewise.ai/threats/technologies/vyper-vyper.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/vyper-vyper","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":2,"all_time":19,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":10,"last_90_days":13,"last_365_days":13},"latest":[{"cve":"CVE-2026-114663","cvss":8.4,"slug":"cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants","title":"Vyper name resolution scope vulnerability in constants and defaults","severity":"high","exploited":false,"published_at":"2026-10-22T02:16:58.603+00:00","url":"https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants"},{"cve":"CVE-2026-114118","cvss":4.8,"slug":"cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint","title":"Vyper create_from_blueprint offset validation bypass via unsigned wraparound","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:38.213+00:00","url":"https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint"},{"cve":"CVE-2026-114117","cvss":5.9,"slug":"cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation","title":"Vyper optimizer miscompilation in ternary expressions","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:38.07+00:00","url":"https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation"},{"cve":"CVE-2026-114116","cvss":5.3,"slug":"cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds","title":"Vyper source-line table parsing allows numeric literal value manipulation","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.93+00:00","url":"https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds"},{"cve":"CVE-2026-114114","cvss":5.3,"slug":"cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1","title":"Vyper source literal value substitution via multi-byte characters","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.64+00:00","url":"https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1"},{"cve":"CVE-2021-48020","cvss":6.5,"slug":"cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption","title":"Vyper memory corruption in internal function calls within arrays","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:19.3+00:00","url":"https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption"},{"cve":"CVE-2021-48019","cvss":4.8,"slug":"cve-2021-48019-vyper-before-0-2-9-deploys-forwarder-proxies-through-the-built-in","title":"Vyper create_forwarder_to incorrect RETURNDATASIZE in proxies","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:19.13+00:00","url":"https://junglewise.ai/threats/cve-2021-48019-vyper-before-0-2-9-deploys-forwarder-proxies-through-the-built-in"},{"cve":"CVE-2021-48018","cvss":7.4,"slug":"cve-2021-48018-vyper-from-0-2-13-before-0-2-15-allocates-storage-slots-for","title":"Vyper storage variable corruption via @nonreentrant decorator","severity":"high","exploited":false,"published_at":"2026-10-21T01:17:18.983+00:00","url":"https://junglewise.ai/threats/cve-2021-48018-vyper-from-0-2-13-before-0-2-15-allocates-storage-slots-for"},{"cve":"CVE-2020-37287","cvss":5.9,"slug":"cve-2020-37287-vyper-before-0-2-6-contains-a-call-stack-corruption-vulnerability","title":"Vyper call stack corruption with complex type arguments","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:18.54+00:00","url":"https://junglewise.ai/threats/cve-2020-37287-vyper-before-0-2-6-contains-a-call-stack-corruption-vulnerability"},{"cve":"CVE-2020-37286","cvss":6.5,"slug":"cve-2020-37286-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption","title":"Vyper memory corruption in nested internal function calls","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:18.01+00:00","url":"https://junglewise.ai/threats/cve-2020-37286-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption"},{"slug":"vyper-memory-corruption-using-function-calls-within-tuples-nested-calls-c0689acb","title":"Vyper memory corruption in nested function calls and tuples","severity":"medium","exploited":false,"published_at":"2026-10-06T15:22:29+00:00","url":"https://junglewise.ai/threats/vyper-memory-corruption-using-function-calls-within-tuples-nested-calls-c0689acb"},{"slug":"vyper-call-stack-corruption-when-passing-complex-type-containing-non-3deb0c30","title":"Vyper stack corruption in complex type argument passing","severity":"medium","exploited":false,"published_at":"2026-10-06T15:22:23+00:00","url":"https://junglewise.ai/threats/vyper-call-stack-corruption-when-passing-complex-type-containing-non-3deb0c30"},{"slug":"vyper-return-inside-for-loop-more-than-1-level-deep-ee8a193d","title":"Vyper return statement in nested for loops causes revert","severity":"medium","exploited":false,"published_at":"2026-10-06T15:20:10+00:00","url":"https://junglewise.ai/threats/vyper-return-inside-for-loop-more-than-1-level-deep-ee8a193d"},{"cve":"CVE-2024-22419","cvss":3.1,"epss":0.0077,"slug":"cve-2024-22419-vyper-concat-built-in-memory-corruption","title":"Vyper concat built-in memory corruption","severity":"low","exploited":false,"published_at":"2024-01-18T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-22419-vyper-concat-built-in-memory-corruption"},{"cve":"CVE-2023-42441","cvss":3.1,"epss":0.0051,"slug":"cve-2023-42441-vyper-reentrancy-lock-bypass-with-empty-string-key","title":"Vyper reentrancy lock bypass with empty string key","severity":"low","exploited":false,"published_at":"2023-09-18T21:16:00+00:00","url":"https://junglewise.ai/threats/cve-2023-42441-vyper-reentrancy-lock-bypass-with-empty-string-key"},{"cve":"CVE-2023-41052","cvss":5.3,"epss":0.0054,"slug":"cve-2023-41052-vyper-incorrect-order-of-evaluation-of-side-effects-in-builtins","title":"Vyper incorrect order of evaluation of side effects in builtins","severity":"medium","exploited":false,"published_at":"2023-09-04T16:39:49+00:00","url":"https://junglewise.ai/threats/cve-2023-41052-vyper-incorrect-order-of-evaluation-of-side-effects-in-builtins"},{"cve":"CVE-2023-31146","cvss":3.1,"epss":0.0124,"slug":"cve-2023-31146-vyper-out-of-bounds-dynarray-access-in-assignment-codegen","title":"Vyper out-of-bounds DynArray access in assignment codegen","severity":"low","exploited":false,"published_at":"2023-05-11T21:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-31146-vyper-out-of-bounds-dynarray-access-in-assignment-codegen"},{"slug":"vyper-memory-corruption-in-function-calls-within-arrays-8e30305b","title":"Vyper memory corruption in function calls within arrays","severity":"info","exploited":false,"published_at":"2021-04-19T15:12:05+00:00","url":"https://junglewise.ai/threats/vyper-memory-corruption-in-function-calls-within-arrays-8e30305b"},{"cvss":3.7,"slug":"vyper-incorrect-returndatasize-in-pre-eip-1167-forwarder-proxies-70c87a3a","title":"Vyper incorrect returndatasize in pre-EIP-1167 forwarder proxies","severity":"info","exploited":false,"published_at":"2021-04-19T15:11:54+00:00","url":"https://junglewise.ai/threats/vyper-incorrect-returndatasize-in-pre-eip-1167-forwarder-proxies-70c87a3a"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":10},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Vyper","slug":"vyper-vyper","vendor":{"hub":true,"name":"Vyper","slug":"vyper","url":"https://junglewise.ai/threats/vendors/vyper"},"aliases":[],"category":"language","description":"Pythonic smart contract programming language designed for the Ethereum Virtual Machine.","url":"https://junglewise.ai/threats/technologies/vyper-vyper"},"most_severe":[{"cve":"CVE-2026-114663","cvss":8.4,"slug":"cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants","title":"Vyper name resolution scope vulnerability in constants and defaults","severity":"high","exploited":false,"published_at":"2026-10-22T02:16:58.603+00:00","url":"https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants"},{"cve":"CVE-2021-48018","cvss":7.4,"slug":"cve-2021-48018-vyper-from-0-2-13-before-0-2-15-allocates-storage-slots-for","title":"Vyper storage variable corruption via @nonreentrant decorator","severity":"high","exploited":false,"published_at":"2026-10-21T01:17:18.983+00:00","url":"https://junglewise.ai/threats/cve-2021-48018-vyper-from-0-2-13-before-0-2-15-allocates-storage-slots-for"},{"cve":"CVE-2021-48020","cvss":6.5,"slug":"cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption","title":"Vyper memory corruption in internal function calls within arrays","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:19.3+00:00","url":"https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption"},{"cve":"CVE-2020-37286","cvss":6.5,"slug":"cve-2020-37286-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption","title":"Vyper memory corruption in nested internal function calls","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:18.01+00:00","url":"https://junglewise.ai/threats/cve-2020-37286-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption"},{"cve":"CVE-2026-114117","cvss":5.9,"slug":"cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation","title":"Vyper optimizer miscompilation in ternary expressions","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:38.07+00:00","url":"https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation"},{"cve":"CVE-2020-37287","cvss":5.9,"slug":"cve-2020-37287-vyper-before-0-2-6-contains-a-call-stack-corruption-vulnerability","title":"Vyper call stack corruption with complex type arguments","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:18.54+00:00","url":"https://junglewise.ai/threats/cve-2020-37287-vyper-before-0-2-6-contains-a-call-stack-corruption-vulnerability"},{"cve":"CVE-2023-41052","cvss":5.3,"epss":0.0054,"slug":"cve-2023-41052-vyper-incorrect-order-of-evaluation-of-side-effects-in-builtins","title":"Vyper incorrect order of evaluation of side effects in builtins","severity":"medium","exploited":false,"published_at":"2023-09-04T16:39:49+00:00","url":"https://junglewise.ai/threats/cve-2023-41052-vyper-incorrect-order-of-evaluation-of-side-effects-in-builtins"},{"cve":"CVE-2026-114116","cvss":5.3,"slug":"cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds","title":"Vyper source-line table parsing allows numeric literal value manipulation","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.93+00:00","url":"https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds"},{"cve":"CVE-2026-114114","cvss":5.3,"slug":"cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1","title":"Vyper source literal value substitution via multi-byte characters","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.64+00:00","url":"https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1"},{"cve":"CVE-2026-114118","cvss":4.8,"slug":"cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint","title":"Vyper create_from_blueprint offset validation bypass via unsigned wraparound","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:38.213+00:00","url":"https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}