https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-27094.htmlhttps://patchthecve.com/cve/CVE-2024-27094.htmlWed, 17 Jun 2026 07:19:09 +0000MEDIUM 6.5: OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulhttps://patchthecve.com/cve/CVE-2023-49798.htmlhttps://patchthecve.com/cve/CVE-2023-49798.htmlWed, 17 Jun 2026 06:36:29 +0000MEDIUM 5.9: OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/contracts@4.9.4` and `@openzeppelin/contracts-upgradeable@4.9.4`, all subcalls are https://patchthecve.com/cve/CVE-2023-34459.htmlhttps://patchthecve.com/cve/CVE-2023-34459.htmlWed, 17 Jun 2026 06:03:41 +0000MEDIUM 5.3: OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the `verifyMultiProof`, `verifyMultiProofCalldata`, `procesprocessMultiProof`, or `processMultiProofCalldat` functions are in use, it is possible to construct merkle trees thttps://patchthecve.com/cve/CVE-2023-34234.htmlhttps://patchthecve.com/cve/CVE-2023-34234.htmlWed, 17 Jun 2026 06:03:11 +0000MEDIUM 5.3: OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Gover