UBUNTU-CVE-2026-19024

NULL pointer dereference in H5Pgetfillvalue in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and...

CVE-2026-19026

The CVE-2026-19026 issue affects HDF5 up to v2.3.0, specifically H5Z__filter_nbit in H5Znbit.c. The code dereferences cd_values[0] through cd_values[4] without verifying that cd_values is non-NULL or that cd_nelmts >= 5, exploiting the fixed size of the filter header. This can cause a denial o...

CVE-2026-19024

CVE-2026-19024 affects HDF5’s H5Pget_fill_value and causes a NULL pointer dereference in versions before 2.1.1. If a dataset uses a version 1 or 2 fill value message with the defined flag and a negative size, the value can reach H5T_path_find with a NULL datatype, leading to a denial of service. ...

CVE-2026-19024 HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message

NULL pointer dereference in H5Pgetfillvalue in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and...

CVE-2026-19024

NULL pointer dereference in H5Pgetfillvalue in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and...

CVE-2026-19024 HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message

NULL pointer dereference in H5Pgetfillvalue in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and...

CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023

The CVE describes an untrusted pointer dereference in the render_bin_output function of the h5dump tool from HDF5, caused by processing a variable-length string dataset with more than one element dumped in binary mode. Affected versions are cited as HDF5 before 2.1.1 (and related entries referenc...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256 nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

EUVD-2026-53333

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256 nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256

nanoMODBUS v1.23.0 is affected by an out-of-bounds stack read that enables a wild-pointer write via object_id handling in nanomodbus.c (nmbs_read_device_identification_basic()/recv_read_device_identification_res). A fixed 3-element array order maps object_id to buffer indices; server-provided obj...

K000162792: Numpy vulnerabilities CVE-2021-34141, CVE-2021-33430, CVE-2021-41496, CVE-2021-41495

Security Advisory Description CVE-2021-34141 An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely...

CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

CVE-2026-64569

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mplsvalidfibdumpreq on CONFIGINET=n On CONFIGINET=n builds, mplsvalidfibdumpreq walks the parsed attribute table itself instead of calling ipvalidfibdumpreq. The RTAOIF arm passes tbRTAOIF to nlagetu32...

CVE-2026-55998

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

UBUNTU-CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

CVE-2026-64575 bpf: tcp: fix double sock release on batch realloc

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...