# Vyper vulnerabilities Source: https://junglewise.ai/threats/vendors/vyper Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/vyper.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Vyper: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114663, was published on 22 October 2026. 10 vulnerabilities in the last four weeks, up 233% on the four before (3). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 10 - Last 90 days: 13 - All time: 20 (0 critical, 0 exploited in the wild) ## Latest Vyper vulnerabilities - [CVE-2026-114663: Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants) (high, CVSS 8.4, published 22 Oct 2026) - [CVE-2026-114118: Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint) (medium, CVSS 4.8, published 21 Oct 2026) - [CVE-2026-114117: Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation) (medium, CVSS 5.9, published 21 Oct 2026) - [CVE-2026-114116: Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-114114: Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2021-48020: Vyper memory corruption in internal function calls within arrays](https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2021-48019: Vyper create_forwarder_to incorrect RETURNDATASIZE in proxies](https://junglewise.ai/threats/cve-2021-48019-vyper-before-0-2-9-deploys-forwarder-proxies-through-the-built-in) (medium, CVSS 4.8, published 21 Oct 2026) - [CVE-2021-48018: Vyper storage variable corruption via @nonreentrant decorator](https://junglewise.ai/threats/cve-2021-48018-vyper-from-0-2-13-before-0-2-15-allocates-storage-slots-for) (high, CVSS 7.4, published 21 Oct 2026) - [CVE-2020-37287: Vyper call stack corruption with complex type arguments](https://junglewise.ai/threats/cve-2020-37287-vyper-before-0-2-6-contains-a-call-stack-corruption-vulnerability) (medium, CVSS 5.9, published 21 Oct 2026) - [CVE-2020-37286: Vyper memory corruption in nested internal function calls](https://junglewise.ai/threats/cve-2020-37286-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption) (medium, CVSS 6.5, published 21 Oct 2026) - [Vyper memory corruption in nested function calls and tuples](https://junglewise.ai/threats/vyper-memory-corruption-using-function-calls-within-tuples-nested-calls-c0689acb) (medium, published 6 Oct 2026) - [Vyper stack corruption in complex type argument passing](https://junglewise.ai/threats/vyper-call-stack-corruption-when-passing-complex-type-containing-non-3deb0c30) (medium, published 6 Oct 2026) - [Vyper return statement in nested for loops causes revert](https://junglewise.ai/threats/vyper-return-inside-for-loop-more-than-1-level-deep-ee8a193d) (medium, published 6 Oct 2026) - [CVE-2025-26622: Vyper sqrt improper rounding behavior in decimal calculations](https://junglewise.ai/threats/cve-2025-26622-vyper-sqrt-improper-rounding-behavior-in-decimal-calculations) (medium, CVSS 4, published 21 Feb 2025) - [CVE-2024-22419: Vyper concat built-in memory corruption](https://junglewise.ai/threats/cve-2024-22419-vyper-concat-built-in-memory-corruption) (low, CVSS 3.1, published 18 Jan 2024) - [CVE-2023-42441: Vyper reentrancy lock bypass with empty string key](https://junglewise.ai/threats/cve-2023-42441-vyper-reentrancy-lock-bypass-with-empty-string-key) (low, CVSS 3.1, published 18 Sep 2023) - [CVE-2023-41052: Vyper incorrect order of evaluation of side effects in builtins](https://junglewise.ai/threats/cve-2023-41052-vyper-incorrect-order-of-evaluation-of-side-effects-in-builtins) (medium, CVSS 5.3, published 4 Sep 2023) - [CVE-2023-31146: Vyper out-of-bounds DynArray access in assignment codegen](https://junglewise.ai/threats/cve-2023-31146-vyper-out-of-bounds-dynarray-access-in-assignment-codegen) (low, CVSS 3.1, published 11 May 2023) - [Vyper memory corruption in function calls within arrays](https://junglewise.ai/threats/vyper-memory-corruption-in-function-calls-within-arrays-8e30305b) (info, published 19 Apr 2021) - [Vyper incorrect returndatasize in pre-EIP-1167 forwarder proxies](https://junglewise.ai/threats/vyper-incorrect-returndatasize-in-pre-eip-1167-forwarder-proxies-70c87a3a) (info, CVSS 3.7, published 19 Apr 2021) ## Most severe Vyper vulnerabilities - [CVE-2026-114663: Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants) (high, CVSS 8.4, published 22 Oct 2026) - [CVE-2021-48018: Vyper storage variable corruption via @nonreentrant decorator](https://junglewise.ai/threats/cve-2021-48018-vyper-from-0-2-13-before-0-2-15-allocates-storage-slots-for) (high, CVSS 7.4, published 21 Oct 2026) - [CVE-2021-48020: Vyper memory corruption in internal function calls within arrays](https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2020-37286: Vyper memory corruption in nested internal function calls](https://junglewise.ai/threats/cve-2020-37286-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-114117: Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation) (medium, CVSS 5.9, published 21 Oct 2026) - [CVE-2020-37287: Vyper call stack corruption with complex type arguments](https://junglewise.ai/threats/cve-2020-37287-vyper-before-0-2-6-contains-a-call-stack-corruption-vulnerability) (medium, CVSS 5.9, published 21 Oct 2026) - [CVE-2023-41052: Vyper incorrect order of evaluation of side effects in builtins](https://junglewise.ai/threats/cve-2023-41052-vyper-incorrect-order-of-evaluation-of-side-effects-in-builtins) (medium, CVSS 5.3, published 4 Sep 2023) - [CVE-2026-114116: Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-114114: Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-114118: Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint) (medium, CVSS 4.8, published 21 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 233% on the four before (3). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 10 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Vyper technologies - [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper): 19 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Vyper vulnerabilities", https://junglewise.ai/threats/vendors/vyper, 9 November 2026.