{"schema":"threatline.record/2","record":{"id":"CVE-2026-106676","aliases":[],"summary":"qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not valida","details":"qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.","categories":["Unclassified"],"product":"n/a","vendor":"n/a","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106676","source_modified_at":"2026-10-26T16:52:04.187Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"n/a","vendor":"n/a","versions":[{"version":"n/a","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T00:00:00.000Z","modified_at":"2026-10-26T16:52:04.187Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106676","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T16:52:04.187Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/qiujie/mall"},{"source":"CVE List","url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106676.md"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T16:52:04.187Z","content_hash":"4304e9e4ae92d133ca02ff648337f2c05c1929b5f6c3bd5e0ff023bbdd9898bb"}}