# vyper (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/vyper Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/vyper.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 47 vulnerabilities in vyper (PyPI): 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Vyper memory corruption in nested function calls and tuples, was published on 6 October 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 47 (0 critical, 0 exploited in the wild) ## About vyper (PyPI) Python programming language for writing smart contracts on Ethereum blockchain. ## Latest vyper (PyPI) vulnerabilities - [Vyper memory corruption in nested function calls and tuples](https://junglewise.ai/threats/vyper-memory-corruption-using-function-calls-within-tuples-nested-calls-c0689acb) (medium, published 6 Oct 2026) - [Vyper stack corruption in complex type argument passing](https://junglewise.ai/threats/vyper-call-stack-corruption-when-passing-complex-type-containing-non-3deb0c30) (medium, published 6 Oct 2026) - [Vyper return statement in nested for loops causes revert](https://junglewise.ai/threats/vyper-return-inside-for-loop-more-than-1-level-deep-ee8a193d) (medium, published 6 Oct 2026) - [CVE-2025-47774: PYSEC-2026-2028 - Vyper's `slice()` may elide side-effects when output length is 0](https://junglewise.ai/threats/cve-2025-47774-vyper-s-slice-may-elide-side-effects-when-output-length-is-0) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-47285: PYSEC-2026-2029 - Vyper's `concat()` builtin may elide side-effects for zero-length arguments](https://junglewise.ai/threats/cve-2025-47285-vyper-s-concat-builtin-may-elide-side-effects-for-zero-length) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-27105: AugAssign evaluation order causing OOB write within the object in Vyper](https://junglewise.ai/threats/cve-2025-27105-augassign-evaluation-order-causing-oob-write-within-the-object-in) (medium, CVSS 4, published 21 Feb 2025) - [CVE-2025-27104: Vyper has a double eval in For List Iter](https://junglewise.ai/threats/cve-2025-27104-vyper-has-a-double-eval-in-for-list-iter) (medium, CVSS 4, published 21 Feb 2025) - [CVE-2025-26622: Vyper sqrt improper rounding behavior in decimal calculations](https://junglewise.ai/threats/cve-2025-26622-vyper-sqrt-improper-rounding-behavior-in-decimal-calculations) (medium, CVSS 4, published 21 Feb 2025) - [CVE-2025-21607: Vyper Does Not Check the Success of Certain Precompile Calls](https://junglewise.ai/threats/cve-2025-21607-vyper-does-not-check-the-success-of-certain-precompile-calls) (medium, CVSS 4, published 14 Jan 2025) - [CVE-2024-32649: vyper performs multiple eval of `sqrt()` argument built in](https://junglewise.ai/threats/cve-2024-32649-vyper-performs-multiple-eval-of-sqrt-argument-built-in) (low, CVSS 3.1, published 25 Apr 2024) - [CVE-2024-32648: vyper default functions don't respect nonreentrancy keys](https://junglewise.ai/threats/cve-2024-32648-vyper-default-functions-don-t-respect-nonreentrancy-keys) (low, CVSS 3.1, published 25 Apr 2024) - [CVE-2024-32646: vyper performs double eval of the slice start/length args in certain cases](https://junglewise.ai/threats/cve-2024-32646-vyper-performs-double-eval-of-the-slice-start-length-args-in) (low, CVSS 3.1, published 25 Apr 2024) - [CVE-2024-32647: vyper performs double eval of raw_args in create_from_blueprint](https://junglewise.ai/threats/cve-2024-32647-vyper-performs-double-eval-of-raw-args-in-create-from-blueprint) (low, CVSS 3.1, published 25 Apr 2024) - [CVE-2024-32645: vyper performs incorrect topic logging in raw_log](https://junglewise.ai/threats/cve-2024-32645-vyper-performs-incorrect-topic-logging-in-raw-log) (low, CVSS 3.1, published 25 Apr 2024) - [CVE-2024-32481: vyper's range(start, start + N) reverts for negative numbers](https://junglewise.ai/threats/cve-2024-32481-vyper-s-range-start-start-n-reverts-for-negative-numbers) (low, CVSS 3.1, published 25 Apr 2024) - [CVE-2024-24564: Vyper's `extract32` can ready dirty memory](https://junglewise.ai/threats/cve-2024-24564-vyper-s-extract32-can-ready-dirty-memory) (low, CVSS 3.1, published 26 Feb 2024) - [CVE-2024-26149: Vyper's `_abi_decode` vulnerable to Memory Overflow](https://junglewise.ai/threats/cve-2024-26149-vyper-s-abi-decode-vulnerable-to-memory-overflow) (low, CVSS 3.1, published 26 Feb 2024) - [CVE-2024-24563: Vyper negative array index bounds checks](https://junglewise.ai/threats/cve-2024-24563-vyper-negative-array-index-bounds-checks) (low, CVSS 3.1, published 7 Feb 2024) - [CVE-2024-24559: Vyper sha3 codegen bug](https://junglewise.ai/threats/cve-2024-24559-vyper-sha3-codegen-bug) (low, CVSS 3.1, published 5 Feb 2024) - [CVE-2024-24560: Vyper's external calls can overflow return data to return input buffer](https://junglewise.ai/threats/cve-2024-24560-vyper-s-external-calls-can-overflow-return-data-to-return-input) (low, CVSS 3.1, published 2 Feb 2024) - [CVE-2024-24561: Vyper's bounds check on built-in `slice()` function can be overflowed](https://junglewise.ai/threats/cve-2024-24561-vyper-s-bounds-check-on-built-in-slice-function-can-be-overflowed) (low, CVSS 3.1, published 1 Feb 2024) - [CVE-2024-24567: Vyper's raw_call `value=` kwargs not disabled for static and delegate calls](https://junglewise.ai/threats/cve-2024-24567-vyper-s-raw-call-value-kwargs-not-disabled-for-static-and) (low, CVSS 3.1, published 30 Jan 2024) - [CVE-2024-22419: Vyper concat built-in memory corruption](https://junglewise.ai/threats/cve-2024-22419-vyper-concat-built-in-memory-corruption) (low, CVSS 3.1, published 18 Jan 2024) - [CVE-2023-46247: incorrect storage layout for contracts containing large arrays](https://junglewise.ai/threats/cve-2023-46247-incorrect-storage-layout-for-contracts-containing-large-arrays) (low, CVSS 3.1, published 13 Dec 2023) - [CVE-2023-42460: Vyper's `_abi_decode` input not validated in complex expressions](https://junglewise.ai/threats/cve-2023-42460-vyper-s-abi-decode-input-not-validated-in-complex-expressions) (low, CVSS 3.1, published 27 Sep 2023) ## Most severe vyper (PyPI) vulnerabilities - [CVE-2023-41052: Vyper incorrect order of evaluation of side effects in builtins](https://junglewise.ai/threats/cve-2023-41052-vyper-incorrect-order-of-evaluation-of-side-effects-in-builtins) (medium, CVSS 5.3, published 4 Sep 2023) - [CVE-2025-21607: Vyper Does Not Check the Success of Certain Precompile Calls](https://junglewise.ai/threats/cve-2025-21607-vyper-does-not-check-the-success-of-certain-precompile-calls) (medium, CVSS 4, published 14 Jan 2025) - [CVE-2025-27105: AugAssign evaluation order causing OOB write within the object in Vyper](https://junglewise.ai/threats/cve-2025-27105-augassign-evaluation-order-causing-oob-write-within-the-object-in) (medium, CVSS 4, published 21 Feb 2025) - [CVE-2025-47774: PYSEC-2026-2028 - Vyper's `slice()` may elide side-effects when output length is 0](https://junglewise.ai/threats/cve-2025-47774-vyper-s-slice-may-elide-side-effects-when-output-length-is-0) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-47285: PYSEC-2026-2029 - Vyper's `concat()` builtin may elide side-effects for zero-length arguments](https://junglewise.ai/threats/cve-2025-47285-vyper-s-concat-builtin-may-elide-side-effects-for-zero-length) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-27104: Vyper has a double eval in For List Iter](https://junglewise.ai/threats/cve-2025-27104-vyper-has-a-double-eval-in-for-list-iter) (medium, CVSS 4, published 21 Feb 2025) - [CVE-2025-26622: Vyper sqrt improper rounding behavior in decimal calculations](https://junglewise.ai/threats/cve-2025-26622-vyper-sqrt-improper-rounding-behavior-in-decimal-calculations) (medium, CVSS 4, published 21 Feb 2025) - [Vyper memory corruption in nested function calls and tuples](https://junglewise.ai/threats/vyper-memory-corruption-using-function-calls-within-tuples-nested-calls-c0689acb) (medium, published 6 Oct 2026) - [Vyper stack corruption in complex type argument passing](https://junglewise.ai/threats/vyper-call-stack-corruption-when-passing-complex-type-containing-non-3deb0c30) (medium, published 6 Oct 2026) - [Vyper return statement in nested for loops causes revert](https://junglewise.ai/threats/vyper-return-inside-for-loop-more-than-1-level-deep-ee8a193d) (medium, published 6 Oct 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 3 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "vyper (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/vyper, 13 November 2026.