Add three new hdf5 CVEs

Keeping them as undetermined as they are all from same reporter not
specifying if upstream has been informed. The issues need first boe be
made aware for upsream.