https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:10:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-5193 EUVD-2026-5193 https://cve.radiocsirt.org/vuln/euvd-2026-5193 https://cve.radiocsirt.org/vuln/fkie_cve-2024-32873 <p>Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.</p> <p>Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-32873 https://cve.radiocsirt.org/vuln/ghsa-pxv8-qhrh-jc7v <p><strong>Affected:</strong> Go: github.com/evmos/evmos/v17, Go: github.com/evmos/evmos/v16, Go: github.com/evmos/evmos/v15, Go: github.com/evmos/evmos/v14, Go: github.com/evmos/evmos/v13, Go: github.com/evmos/evmos/v12, Go: github.com/evmos/evmos/v11, Go: github.com/evmos/evmos/v10, Go: github.com/evmos/evmos/v9, Go: github.com/evmos/evmos/v8 and 2 more</p> <p>## Impact</p> <p>This advisory has been created to address the following vulnerabilities found in the Evmos codebase and affecting vesting accounts.</p> <p>### Wrong spendable balance computation</p> <p>The spendable balance is not updated properly when delegating vested tokens. The following example help in describing the issue: - Given a clawback vesting account with a starting `15M` vesting schedule. The initial spendable balance is `0`. - Time passes and `5M` are vested. The spendable balance is now `5M`. - The account delegate `5M`. The spendable balance should be `0`, but returns `5M` - The account can send `5M` to another account.</p> <p>The issue allowed a clawback vesting account to anticipate the release of unvested tokens.</p> <p>### Missing precompile checks</p> <p>Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different.</p> <p>The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module.</p> <p>### Missing create validator check</p> <p>This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond.</p> <p>## Patches</p> <p>- The spendable balance function has been fixed correcting the `TrackDelegation` function. - The checks for the staking…</p> <p><strong>Affected:</strong> Go: github.com/evmos/evmos/v17, Go: github.com/evmos/evmos/v16, Go: github.com/evmos/evmos/v15, Go: github.com/evmos/evmos/v14, Go: github.com/evmos/evmos/v13, Go: github.com/evmos/evmos/v12, Go: github.com/evmos/evmos/v11, Go: github.com/evmos/evmos/v10, Go: github.com/evmos/evmos/v9, Go: github.com/evmos/evmos/v8 and 2 more</p> <p>## Impact</p> <p>This advisory has been created to address the following vulnerabilities found in the Evmos codebase and affecting vesting accounts.</p> <p>### Wrong spendable balance computation</p> <p>The spendable balance is not updated properly when delegating vested tokens. The following example help in describing the issue: - Given a clawback vesting account with a starting `15M` vesting schedule. The initial spendable balance is `0`. - Time passes and `5M` are vested. The spendable balance is now `5M`. - The account delegate `5M`. The spendable balance should be `0`, but returns `5M` - The account can send `5M` to another account.</p> <p>The issue allowed a clawback vesting account to anticipate the release of unvested tokens.</p> <p>### Missing precompile checks</p> <p>Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different.</p> <p>The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module.</p> <p>### Missing create validator check</p> <p>This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond.</p> <p>## Patches</p> <p>- The spendable balance function has been fixed correcting the `TrackDelegation` function. - The checks for the staking…</p> https://cve.radiocsirt.org/vuln/ghsa-pxv8-qhrh-jc7v https://cve.radiocsirt.org/vuln/gsd-2024-32873 gsd-2024-32873 https://cve.radiocsirt.org/vuln/gsd-2024-32873