Missing authorization in Gastromenum Ticket and QR Menu System (all versions before 2026.08.31) allows authenticated low-privileged users to access functionality and data that ACLs should restrict, leaking confidential information. The flaw was disclosed by Turkish USOM (iletisim@usom.gov.tr) and tracked under TR-26-1012. No public exploit code or active exploitation has been identified; the vendor released a fix in the 2026.08.31 build.
Stored cross-site scripting in Stormshield Network Security's web administration panel allows an authenticated administrator who injects malicious script into group comments within the webservices interface to execute arbitrary JavaScript in the browser session of any other administrator who subsequently views that group entry. The CVSS 4.3 score reflects the constrained preconditions: adjacent network access, high privileges, and required user interaction by a second victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap buffer overflow in libavif's `scale_nearest_neighbor()` function can be triggered by a crafted AVIF image containing nested `iden`/`auxl` items that introduce duplicate Alpha planes. An attacker who delivers a malicious AVIF file to an application or service that decodes it - browsers, image editors, server-side media pipelines - can cause heap memory corruption, leading to denial of service or potentially arbitrary code execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability class (heap overflow in a media parser) carries inherent code-execution potential.
Out-of-bounds read in libheif 1.23.1 persists because the upstream patch for GHSA-73p7-m7gg-w2jv was incomplete, leaving the library still vulnerable in its latest release at time of disclosure. Any application or pipeline that uses libheif to parse HEIF/HEIC image files - including desktop viewers, photo management tools, and server-side media processors - is exposed when handling untrusted image input. The practical impact is at minimum information disclosure (heap memory leak) and potential application crash; no public exploit has been identified at time of analysis.
CVE-2026-84471 was reported by Ubuntu but carries no description, CVSS data, CWE classification, or reference links at time of analysis. The affected component, vulnerability class, and impact are entirely unknown. No meaningful synthesis is possible; this record requires enrichment from the Ubuntu Security Notices (USN) or NVD before any risk assessment can be made.
Out-of-bounds read in libheif 1.23.1 persists because the patch shipped for GHSA-73p7-m7gg-w2jv did not fully remediate the underlying flaw. Processing a specially crafted HEIF or HEIC image file can trigger a read beyond allocated buffer bounds, potentially leaking heap memory contents or crashing the parsing application. Ubuntu has flagged this regression, meaning deployments that upgraded to 1.23.1 expecting full protection remain exposed to the original vulnerability class.