UNKNOWN NVD

CVE-2026-106676

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value.

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

References

https://github.com/qiujie/mall
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106676.md

Published: 2026-10-26 · Source: NVD · Feed updated: 2026-10-26

This unknown severity vulnerability was published on 2026-10-26 via NVD.

vulnfeed aggregates 18200 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.