openvm-org has 2 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 8.7 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.7
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
openvm-org vulnerabilities
CVEs affecting openvm-org, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-62333High· 8.7OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height`…
CVE-2026-62334High· 8.7OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-contr…
CVE-2026-62335Medium· 6.9OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` accepts `appExeCommit` and `appVmCommit` as `…