Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 4 total.

Severity: All Critical High

Library: N A

CVE-2026-52134 CRITICAL CVSS 9.8 Verified Advisory Aug 03, 2026

Authentication bypass in libIEC61850 GOOSE frame parser (CVE-2026-52134)

A flaw in the parseGoosePayload() function in /goose/goose_receiver.c allows an attacker to bypass authentication by replaying or crafting a captured GOOSE frame. Successful exploitation may allow unauthorized control...

Fixed in 1.6.2

Authentication Bypass N A

CVE-2026-29649 CRITICAL CVSS 9.8 Verified Advisory Jul 24, 2026

Incorrect CSR dependency between henvcfg and menvcfg in NEMU (CVE-2026-29649)

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where the CBIE, CBCFE, and CBZE fields of henvcfg (bits 7:4) are incorrectly made dependent on the corresponding fields of menvcfg. A machine-...

Fixed in Release v2025.12.r1

Denial Of Service N A

CVE-2026-45390 CRITICAL CVSS 9.1 Verified Advisory Jul 23, 2026

Path traversal in ocaml-tar allows arbitrary file write (CVE-2026-45390)

A path traversal vulnerability in ocaml-tar allows a maliciously crafted archive containing `../` path segments to escape the intended extraction directory. The `Tar_unix.extract` function passes unsanitized filenames...

Fixed in 3.5.0

Path Traversal N A

CVE-2026-36537 CRITICAL CVSS 9.8 Verified Advisory Jul 23, 2026

Authentication bypass and account takeover in ThingsBoard (CVE-2026-36537)

ThingsBoard improperly trusts user-supplied identity data in the `user` parameter of the `/login/oauth2/code/` OAuth 2.0 authorization code exchange endpoint. A remote attacker can manipulate the email address in this...

Fixed in ThingsBoard v4.2.2.1; ThingsBoard v4.3.1.1

Authentication Bypass Microsoft N A