https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-27105.htmlhttps://patchthecve.com/cve/CVE-2025-27105.htmlWed, 17 Jun 2026 09:03:02 +0000CRITICAL 9.1: vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounhttps://patchthecve.com/cve/CVE-2025-27104.htmlhttps://patchthecve.com/cve/CVE-2025-27104.htmlWed, 17 Jun 2026 09:03:02 +0000HIGH 7.5: vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updahttps://patchthecve.com/cve/CVE-2025-26622.htmlhttps://patchthecve.com/cve/CVE-2025-26622.htmlWed, 17 Jun 2026 09:02:08 +0000HIGH 7.5: vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed https://patchthecve.com/cve/CVE-2025-21607.htmlhttps://patchthecve.com/cve/CVE-2025-21607.htmlWed, 17 Jun 2026 08:43:50 +0000HIGH 7.5: Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executhttps://patchthecve.com/cve/CVE-2024-26149.htmlhttps://patchthecve.com/cve/CVE-2024-26149.htmlWed, 17 Jun 2026 07:17:12 +0000LOW 3.7: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentiahttps://patchthecve.com/cve/CVE-2024-24564.htmlhttps://patchthecve.com/cve/CVE-2024-24564.htmlWed, 17 Jun 2026 07:14:36 +0000LOW 3.7: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extracthttps://patchthecve.com/cve/CVE-2024-24563.htmlhttps://patchthecve.com/cve/CVE-2024-24563.htmlWed, 17 Jun 2026 07:14:36 +0000CRITICAL 9.8: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an `int` as an index for an array. The typechecker allows the usage of sihttps://patchthecve.com/cve/CVE-2024-24560.htmlhttps://patchthecve.com/cve/CVE-2024-24560.htmlWed, 17 Jun 2026 07:14:36 +0000LOW 3.7: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 (overlapping with the input buffer). When checking RETURNDATASIZE for dynamic typehttps://patchthecve.com/cve/CVE-2024-24561.htmlhttps://patchthecve.com/cve/CVE-2024-24561.htmlWed, 17 Jun 2026 07:14:36 +0000CRITICAL 9.8: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start ohttps://patchthecve.com/cve/CVE-2024-24567.htmlhttps://patchthecve.com/cve/CVE-2024-24567.htmlWed, 17 Jun 2026 07:14:37 +0000MEDIUM 4.8: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of https://patchthecve.com/cve/CVE-2024-22419.htmlhttps://patchthecve.com/cve/CVE-2024-22419.htmlWed, 17 Jun 2026 07:11:22 +0000HIGH 7.3: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API o