https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:58:09.238944+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5836 EUVD-2026-5836 2026-10-05T21:58:09.289829+00:00 EUVD-2026-5836 https://cve.radiocsirt.org/vuln/fkie_cve-2024-37154 fkie_cve-2024-37154 2026-10-05T21:58:09.289870+00:00

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`. This affects 18.1.0 and earlier.

 https://cve.radiocsirt.org/vuln/ghsa-7hrh-v6wp-53vw GHSA-7hrh-v6wp-53vw — Evmos allows unvested token delegations 2026-10-05T21:58:09.289904+00:00

Affected: Go: github.com/evmos/evmos/v18, Go: github.com/evmos/evmos/v17, Go: github.com/evmos/evmos/v16, Go: github.com/evmos/evmos/v15, Go: github.com/evmos/evmos/v14, Go: github.com/evmos/evmos/v13, Go: github.com/evmos/evmos/v12, Go: github.com/evmos/evmos/v11, Go: github.com/evmos/evmos/v10, Go: github.com/evmos/evmos/v9 and 3 more

### Impact _What kind of vulnerability is it? Who is impacted?_

At the moment, users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`.

### Patches _Has the problem been patched? What versions should users upgrade to?_

[The PR linked to this advisory](https://github.com/evmos/evmos-ghsa-7hrh-v6wp-53vw/pull/1) includes part of the fix. The remainder is in a [second advisory on the Cosmos SDK fork](https://github.com/evmos/cosmos-sdk/security/advisories/GHSA-wj6f-x5wv-8pqv).

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

There is no effective workaround to fix or remediate this issue without a new release. The best solution is to contain the information about this vulnerability to minimize the number of users who know about it and can thus exploit it.

### References _Are there any links users can visit to find out more?_

See the integration tests for more details on the exploit, or use the following to reproduce it on the CLI:

1. Download `vesting_setup.json` with the following contents: ``` { "start_time": 1679602272, "periods": [ { "coins": "100000000000000000000aevmos", "length_seconds": 10 }, { "coins": "100000000000000000000aevmos", "length_seconds": 259200000 } ] } ```

2. Run the following CLI commands to reproduce the issue locally: ``` evmosd tx vesting create-clawba…