761 matches found
@raycashxyz/confidential-primitives (>=0.1.0, <=0.1.1), @zentity/contracts (>=0.6.0, <=0.7.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (>=0.3.0, <=0.3.1)
@openzeppelin/confidential-contracts NPM version =0.3.0, =0.1.0, =0.6.0, =0.1.0, =0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-29H2-JR22-FRMH...
@gudman/charter-conformance (0.1.0), @gudman/charter-core (0.1.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.5.1)
@openzeppelin/confidential-contracts NPM version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @gudman/charter-conformance 0.1.0 - @gudman/charter-core 0.1.0 -...
@gudman/charter-conformance (0.1.0), @gudman/charter-core (0.1.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.5.1)
@openzeppelin/confidential-contracts NPM version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @gudman/charter-conformance 0.1.0 - @gudman/charter-core 0.1.0 -...
@gudman/charter-conformance (0.1.0), @gudman/charter-core (0.1.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.5.1)
@openzeppelin/confidential-contracts NPM version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @gudman/charter-conformance 0.1.0 - @gudman/charter-core 0.1.0 -...
@raycashxyz/confidential-primitives (>=0.1.0, <=0.1.1), @zentity/contracts (>=0.6.0, <=0.7.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (>=0.3.0, <=0.3.1)
@openzeppelin/confidential-contracts NPM version =0.3.0, =0.1.0, =0.6.0, =0.1.0, =0.5.0 Source cves: unknown CVE Source advisory: GHSA-29H2-JR22-FRMH...
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it. VestingWalletConfidential Malicious users can call release with a malicious token. This token could return an alternative handle on...
Improper Authorization
Overview @openzeppelin/confidential-contracts is a Smart Contract library for use with confidential coprocessors Affected versions of this package are vulnerable to Improper Authorization via the release and vestedAmount functions in VestingWalletConfidential.sol, which consume encrypted FHE...
@raycashxyz/confidential-primitives (>=0.1.0, <=0.1.1), @zentity/contracts (>=0.6.0, <=0.7.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (>=0.3.0, <=0.3.1)
@openzeppelin/confidential-contracts NPM version =0.3.0, =0.1.0, =0.6.0, =0.1.0, =0.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-OPENZEPPELINCONFIDENTIALCONTRACTS-20158601...
GHSA-29H2-JR22-FRMH OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it. VestingWalletConfidential Malicious users can call release with a malicious token. This token could return an alternative handle on...
CVE-2026-57583
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...
CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...
@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.5) +1 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stylus (0.2.0)
@openzeppelin/wizard-stylus NPM version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/wizard-stylus and may be impacted: - @m3s/smart-contract =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory:...
CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...
CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...
@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.6) +2 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-cairo (>=0.1.0, <=2.1.0)
@openzeppelin/wizard-cairo NPM version =0.1.0, =1.1.5, =0.0.5, =0.0.1, =0.1.4, =0.1.6 Source cves: CVE-2026-57583 Source advisory: MEND:CVE-2026-57583...
@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-cli (0.1.0) +2 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stellar (>=0.1.1, <=0.5.0)
@openzeppelin/wizard-stellar NPM version =0.1.1, =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory: MEND:CVE-2026-57583...
EUVD-2026-77702
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...
CVE-2026-57583
OpenZeppelin Contracts Wizard (npm packages @openzeppelin/wizard, @openzeppelin/wizard-cairo, @openzeppelin/wizard-stellar, @openzeppelin/wizard-stylus) is affected by an improper encoding/escaping vulnerability in the setInfo code path. The fields info.securityContact and info.license are printe...
@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)
@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-57583 Source advisory: MEND:CVE-2026-57583...
CVE-2026-57583: Improper Control of Generation of Code
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...