Threat database

CVE-2026-110607 is a high-severity vulnerability in BizSpring Shop version 0 that allows authenticated buyers to bypass payment verification. By exploiting the PaymentController.testPostPay handler, attackers can mark orders as paid without actual payment. This enables unauthorized acquisition of goods or settling other members' orders fraudulently.

CVE-2026-110606 is a medium severity stack-based out-of-bounds read vulnerability in the libdxfrw component of LibreCAD through version 2.2.1.5. It occurs in the dwgReader18::readFileHeader() function when strlen is called on buffers that are not NUL-terminated. Crafted DWG files with specific versions (AC1018, AC1024, AC1027) lacking NUL bytes in the decrypted header can trigger this issue, potentially causing a crash.

CVE-2026-110605 is a divide by zero vulnerability in the libschrift library (up to version 0.10.2). It occurs when a crafted TrueType font with unitsPerEm set to 0 in the head table is processed, causing a crash due to an out-of-bounds raster read triggered by NaN glyph coordinates bypassing clip_points().

Mini-XML versions 4.0.0 through 4.0.6 have an off-by-one stack out-of-bounds write vulnerability in the mxml_strtod() function when the locale decimal point is not '.'. An attacker can exploit this by supplying XML with a 63-digit REAL value followed by a '.' character, causing a NUL byte to be written past the 64-byte stack buffer, potentially corrupting stack memory or crashing the process. The vulnerability has a low severity score and no known exploits in the wild.

CVE-2026-110603 is a medium severity vulnerability in LASzip up to version 3.5.0. It involves an invalid free of uninitialized heap pointers in the laszip_read_header() function triggered by crafted LAS/LAZ files with inflated variable length record (VLR) counts. This can cause process crashes and heap corruption when the file is opened and closed via the C API.

CVE-2026-110602 is a medium severity vulnerability in libmspack (up to version 0.11alpha) involving an uninitialized pointer free in the kwajd_open() function. This flaw occurs when the function frees uninitialized filename and extra pointers upon encountering header read errors in KWAJ files. An attacker can trigger this by supplying malformed KWAJ files, potentially causing a crash or enabling arbitrary memory corruption.

libsixel versions before 1.8.7-r1 and from 1.9.0 through 1.10.5 contain a heap out-of-bounds write vulnerability in the gif_init_frame() function. This occurs because the function does not verify the GIF transparent color index against the palette size, allowing crafted GIFs with a small color table and large transparent index to cause heap corruption or crashes.

A NULL pointer dereference vulnerability exists in xlsxio through version 0.2.37. This occurs in the function main_sheet_get_sheetfile_expat_callback_element_start() when processing a crafted .xlsx file with a worksheet Relationship missing an Id attribute. The vulnerability can cause affected applications to crash when calling xlsxioread_sheet_open().

CVE-2026-110598 is an integer underflow vulnerability in libyal's libpff library (version 0). It occurs in the function libpff_record_entry_get_multi_value(), allowing crafted PST, OST, or PAB files with non-monotonic multi-value offsets to trigger heap out-of-bounds reads. This can cause crashes in libpff and related tools such as pypff or pffexport and may expose adjacent heap memory.

Tinyexr versions up to 3.2.0 have a heap out-of-bounds read vulnerability in the function ParseEXRMultipartHeaderFromMemory(). This flaw allows attackers to craft multi-part EXR files that bypass bounds checks, potentially causing application crashes or leaking adjacent heap memory. The vulnerability arises from a stale remaining-size value leading to reading beyond buffer limits.

quirc versions up to 1.2 contain an excessive-iteration vulnerability in the find_alignment_pattern() function. This flaw allows attackers to craft QR images that cause the quirc_end() function to hang by triggering billions of iterations in region_code(), leading to CPU exhaustion. The vulnerability arises from arranging three finder patterns to produce a near-degenerate perspective transform.

BottleCRM versions 0.45 through 1.14.5 have a vulnerability in the _read_upload() function where the application reads entire CSV uploads before enforcing the 5 MB size limit. Authenticated users with mass-import permission can exploit this by sending oversized CSV files concurrently to specific import endpoints, causing excessive memory consumption and potential out-of-memory termination.

BottleCRM versions 0.43 through 1.14.5 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated organization administrators can create routing rules with complex regex patterns that cause catastrophic backtracking. This leads to exhaustion of web workers shared across all tenants when the _match_condition() function evaluates these patterns during case saves.

BottleCRM versions up to 1.14.5 contain a server-side template injection vulnerability in the send_email Celery task. Authenticated organization members can exploit this by submitting template tags via a specific API endpoint to disclose rendering context and loaded Python modules or cause denial of service by blocking the Celery worker with nested loops. The vulnerability has a medium severity with a CVSS score of 5.3.

BottleCRM versions 0.30 through 1.14.5 have an HTML injection vulnerability in the render_invoice_template() function. Authenticated organization members can inject HTML and CSS into invoice PDFs via fields such as notes, terms, client name, or address. This allows attackers to manipulate the visual content of PDFs delivered through downloads, public links, and emails.

OW2 ASM versions from 1.4.3 up to but not including 9.11 contain a vulnerability in the Analyzer.analyze() function that allows attackers to cause excessive resource consumption. By supplying crafted class files analyzed through BasicVerifier, SimpleVerifier, or SourceInterpreter, attackers can trigger unbounded allocation of Frames and fix point iterations, leading to denial of service due to memory and CPU exhaustion.

CVE-2026-110270 is a medium severity vulnerability in OW2 ASM affecting versions 3.0 up to but not including 9.11. It involves an inefficient algorithmic complexity in the asm-commons JSRInlinerAdapter component, which inlines JSR/RET subroutines without limits. Crafted class files with nested subroutines can cause exponential memory allocation, leading to OutOfMemoryError and JVM crashes.

CVE-2026-110263 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves uncontrolled recursion in the SignatureReader.parseType() method, which can be triggered by a crafted class file containing deeply nested generic type signatures. This causes a StackOverflowError during class transformation, resulting in a denial of service condition.

CVE-2026-110262 is a medium severity vulnerability in OW2 ASM affecting versions from 3.1 up to but not including 9.11. It involves excessive memory allocation in the asm-commons AdviceAdapter component, where crafted class files with many forward jump targets in constructors cause unbounded stack copies and large memory consumption, leading to denial of service.

OW2 ASM versions 3.0 up to but not including 9.11 contain a denial of service vulnerability due to inefficient algorithmic complexity in the ClassWriter.COMPUTE_FRAMES processing. Crafted class files can cause the MethodWriter.computeAllFrames() algorithm to converge very slowly, leading to CPU exhaustion and tying up threads indefinitely.