https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:46:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-213996 EUVD-2026-213996 https://cve.radiocsirt.org/vuln/euvd-2026-213996 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30542 <p>OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.</p> <p>OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30542 https://cve.radiocsirt.org/vuln/ghsa-93hq-5wgc-jc82 <p><strong>Affected:</strong> npm: @openzeppelin/contracts, npm: @openzeppelin/contracts-upgradeable</p> <p>### Impact</p> <p>The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata.</p> <p>### Patches</p> <p>This issue has been patched in v4.8.3.</p> <p>### Workarounds</p> <p>Ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.</p> <p><strong>Affected:</strong> npm: @openzeppelin/contracts, npm: @openzeppelin/contracts-upgradeable</p> <p>### Impact</p> <p>The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata.</p> <p>### Patches</p> <p>This issue has been patched in v4.8.3.</p> <p>### Workarounds</p> <p>Ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.</p> https://cve.radiocsirt.org/vuln/ghsa-93hq-5wgc-jc82 https://cve.radiocsirt.org/vuln/gsd-2023-30542 gsd-2023-30542 https://cve.radiocsirt.org/vuln/gsd-2023-30542