wevm has 4 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.2 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-63628Medium· 6.9mppx is a TypeScript interface for machine payments protocol50CVE-2026-34210High· 8.1mppx is a TypeScript interface for machine payments protocol45CVE-2026-34209High· 7.5mppx is a TypeScript interface for machine payments protocol41CVE-2026-63627Medium· 6.9mppx is a TypeScript interface for machine payments protocol38
wevm vulnerabilities
CVEs affecting wevm, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-63627Medium· 6.9mppx is a TypeScript interface for machine payments protocol
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could …
CVE-2026-63628Medium· 6.9PoCmppx is a TypeScript interface for machine payments protocol
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length…
CVE-2026-34210High· 8.1mppx is a TypeScript interface for machine payments protocol
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a v…
CVE-2026-34209High· 7.5mppx is a TypeScript interface for machine payments protocol
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attac…