https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-45056.htmlhttps://patchthecve.com/cve/CVE-2024-45056.htmlWed, 17 Jun 2026 07:53:30 +0000MEDIUM 5.9: zksolc is a Solidity compiler for ZKsync. All LLVM versions since 2015 fold `(xor (shl 1, x), -1)` to `(rotl ~1, x)` if run with optimizations enabled. Here `~1` is generated as an unsigned 64 bits number (`2^64-1`). This number is zero-extended to 256 bits on EraVM target while it should have been https://patchthecve.com/cve/CVE-2024-43366.htmlhttps://patchthecve.com/cve/CVE-2024-43366.htmlWed, 17 Jun 2026 07:50:53 +0000HIGH 7.5: zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However, morehttps://patchthecve.com/cve/CVE-2023-46232.htmlhttps://patchthecve.com/cve/CVE-2023-46232.htmlWed, 17 Jun 2026 06:30:27 +0000MEDIUM 5.3: era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem a