vyper has 28 CVEs on record between 2020 and 2026. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 7.3 (high), with 2 rated critical. None have a confirmed exploitation report.

CVEs per month

Weakness classes

Products

Worst active — by depth score

vyper vulnerabilities

Vyper: Return inside for loop more than 1 level deep

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Vyper: Return inside for loop more than 1 level deep

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Vyper: Memory corruption using function calls within tuples / nested calls

Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Vyper's `slice()` may elide side-effects when output length is 0

Vyper Does Not Check the Success of Certain Precompile Calls

Vyper negative array index bounds checks

Vyper sha3 codegen bug

Vyper's external calls can overflow return data to return input buffer

Vyper's bounds check on built-in `slice()` function can be overflowed

Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

concat built-in can corrupt memory in vyper

incorrect storage layout for contracts containing large arrays

Vyper has incorrect re-entrancy lock when key is empty string

incorrect order of evaluation of side effects for some builtins

Vyper has incorrectly allocated named re-entrancy locks

Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Vyper vulnerable to integer overflow in loop

Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

vyper vulnerable to storage allocator overflow

Incorrect success value returned in vyper

Memory corruption when returning a literal struct with a private call inside of it

missing clamps for decimal args in external functions

Storage corruption due to variables overwritten by re-entrancy locks

VVE-2021-0001: Memory corruption using function calls within arrays

Vyper interfaces returning integer types less than 256 bits can be manipulated if uint256 is used