CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023

The CVE describes an untrusted pointer dereference in the render_bin_output function of the h5dump tool from HDF5, caused by processing a variable-length string dataset with more than one element dumped in binary mode. Affected versions are cited as HDF5 before 2.1.1 (and related entries referenc...

CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When vue.runtimeCompiler: true is enabled off by default and the application has a server island component that forwards props into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can inject a...

GHSA-9473-5F9J-94WQ Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When vue.runtimeCompiler: true is enabled off by default and the application has a server island component that forwards props into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can inject a...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the as prop in server island components that forward attacker-controlled values into dynamic component resolution. An attacker can instantiate any...

Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

GHSA-48HR-524C-V5W3 Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the as prop in server island components that forward attacker-controlled values into dynamic...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the as prop in server island components that forward attacker-controlled values into dynamic component resolution. An attacke...

Exploit for NULL Pointer Dereference in Linux Linux_Kernel

--- CVE-2026-23002 – 5G NAS Message Buffer Overflow in gNode...

GHSA-HXCR-HM88-MPQ6 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop for example v-for="n in count" or a . Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props a...

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop for example v-for="n in count" or a . Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props a...

GHSA-FQJ9-69PF-6PJG rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Summary rclone serve restic --private-repos exists to let one rclone instance host many users' restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of //. The documentation states the flag "can be used to limit users to repositories starting with a...

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Summary rclone serve restic --private-repos exists to let one rclone instance host many users' restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of //. The documentation states the flag "can be used to limit users to repositories starting with a...

Exposure of Data Element to Wrong Session

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the extension tab and scripting APIs not being properly scoped to the...

Exposure of Data Element to Wrong Session

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the extension tab and scripting APIs not being properly scope...