CVE-2026-19027 - HDF5 out-of-bounds heap read in N-Bit filter decompression
CVE ID :CVE-2026-19027
Published : Aug. 5, 2026, 11:12 p.m. | 52 minutes ago
Description :The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19027
Published : Aug. 5, 2026, 11:12 p.m. | 52 minutes ago
Description :The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19028 - HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read
CVE ID :CVE-2026-19028
Published : Aug. 5, 2026, 11:15 p.m. | 50 minutes ago
Description :H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19028
Published : Aug. 5, 2026, 11:15 p.m. | 50 minutes ago
Description :H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19023 - HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets
CVE ID :CVE-2026-19023
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.
Severity: 0.0 | NONE
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19023
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.
Severity: 0.0 | NONE
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19024 - HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message
CVE ID :CVE-2026-19024
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19024
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19025 - HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open
CVE ID :CVE-2026-19025
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19025
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19026 - Nbit filter NULL/short parameter-array dereference
CVE ID :CVE-2026-19026
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19026
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-67863 - open62541 Use-After-Free Vulnerability
CVE ID :CVE-2026-67863
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-67863
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-67866 - Systerel S2OPC Buffer Overflow Vulnerability
CVE ID :CVE-2026-67866
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems in the client wrapper DeleteMonitoredItems path
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-67866
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems in the client wrapper DeleteMonitoredItems path
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-67867 - Systerel S2OPC Buffer Overflow
CVE ID :CVE-2026-67867
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-67867
Published : Aug. 5, 2026, 11:16 p.m. | 48 minutes ago
Description :Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18969 - Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload
CVE ID :CVE-2026-18969
Published : Aug. 5, 2026, 11:30 p.m. | 34 minutes ago
Description :A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18969
Published : Aug. 5, 2026, 11:30 p.m. | 34 minutes ago
Description :A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-54383 - Rejected reason: Erroneously reserved under wrong
CVE ID :CVE-2023-54383
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2023-54383
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-54384 - Rejected reason: Erroneously reserved under wrong
CVE ID :CVE-2023-54384
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2023-54384
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-54385 - Rejected reason: Erroneously reserved under wrong
CVE ID :CVE-2023-54385
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2023-54385
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-54386 - Rejected reason: Erroneously reserved under wrong
CVE ID :CVE-2023-54386
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2023-54386
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-54387 - Rejected reason: Erroneously reserved under wrong
CVE ID :CVE-2023-54387
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2023-54387
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-54388 - Rejected reason: Erroneously reserved under wrong
CVE ID :CVE-2023-54388
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2023-54388
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-54389 - Rejected reason: Erroneously reserved under wrong
CVE ID :CVE-2023-54389
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2023-54389
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18970 - Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection
CVE ID :CVE-2026-18970
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18970
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-52466 - VuFind Incorrect Access Control Vulnerability
CVE ID :CVE-2026-52466
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-52466
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-67869 - open62541 Buffer Overflow Vulnerability
CVE ID :CVE-2026-67869
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-resolved InputArguments metadata
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-67869
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-resolved InputArguments metadata
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-67870 - open62541 Null Pointer Dereference Vulnerability
CVE ID :CVE-2026-67870
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-67870
Published : Aug. 6, 2026, 12:16 a.m. | 3 hours, 49 minutes ago
Description :In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...