Approval bypass in the Nextcloud Approval app allows an authenticated user holding approve/reject privileges - or an attacker positioned to intercept and modify that approver's outbound approve/reject HTTP request - to approve or reject a file version whose contents changed after the approver reviewed it, simply by omitting or blanking the etag parameter. The backend only applied its etag freshness check when the parameter was present and non-empty, so the review-integrity control is skippable; impact is limited to integrity of the approval decision (CVSS 4.3, PR:L, no confidentiality or availability effect). No public exploit code was identified at time of analysis, and this is assessed as a genuinely low-priority issue whose signals are consistent.
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-write note share link download an uploaded file or image from the same project by editing the shared note to reference the target asset filename. The shared-note authorization logic trusts that user-controlled reference and treats the asset as permitted, so the attacker can then retrieve it; the impact is confined to the project tied to the share link, filenames cannot be enumerated, and the attacker must already know the exact filename. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.68; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), which the independent assessment narrows to a confidentiality-only impact (C:L/I:N/A:N).
Parameter substitution in the Elytron token-realm of Red Hat JBoss EAP 7, JBoss EAP 8 and the EAP Expansion Pack allows a remote attacker to manipulate OAuth2 token-introspection requests because parameters are assembled without URL encoding. Only deployments whose application security domain is backed by a token-realm configured with oauth2-introspection are exposed; other realm types (properties, JDBC, LDAP, or JWT validation without introspection) are unaffected, and the achievable impact is limited to Low confidentiality and Low integrity with no availability impact. Vendor scoring is 4.2 on an AC:H basis because success hinges on how the downstream introspection endpoint parses the injected parameters, and no public exploit has been identified at time of analysis.
Heap out-of-bounds read in libheif prior to 1.23.2 lets an application that builds inline-mask region metadata through the library's writer API leak adjacent heap memory or crash. Specifically, heif_region_item_add_region_inline_mask_data() stored a caller-supplied mask buffer without verifying that mask_data_len equals ceil(width*height/8); a later heif_region_get_mask_image() render derives the number of bytes to read from the region geometry, so an undersized buffer causes the reader to copy bytes past the end of the allocation into the returned monochrome mask image. The file-parsing/decode path validates the canonical mask size and is explicitly not vulnerable, so merely opening a crafted HEIF/AVIF file does not trigger the bug; exploitation requires a local program in which attacker-influenced geometry and mask data disagree, consistent with the assessed vector AV:L/AC:H/PR:N/UI:N (CVSS 4.0). There is no confirmed active exploitation (no CISA KEV listing), and no public exploit code was identified at time of analysis; the issue is a genuine but low-priority memory-safety defect rather than an emergency, and version 1.23.2 fixes it.