CVE-2026-110594

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

EUVD-2026-101222

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

CVE-2026-110594 BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

CVE-2026-110594 BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

CVE-2026-110594

BottleCRM versions 0.43 through 1.14.5 are vulnerable to a Regular Expression Denial of Service (ReDoS) . The flaw exists because the application evaluates unbounded routing rule regex patterns within the _match_condition() function during case saves. An authenticated organization administrator c...

CVE-2026-110594 BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

PT-2026-114036

🚨 CVE-2026-110594 BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447 Authentication Bypass by Spoofing in Malcolm

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447 Authentication Bypass by Spoofing in Malcolm

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447

This ICS-CERT advisory (CSAF reference: ICSA-26-254-01) describes a privilege escalation vulnerability in a downstream service where a routing rule selects between two authentication mechanisms based on a client-supplied request header . An authenticated user possessing a shared service credentia...

CVE-2020-6879

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule...

PT-2020-19289

Name of the Vulnerable Software and Affected Versions ZXHN Z500 versions 1.0.0.2B1.1000 through 1.0.0.2B1.1000 ZXHN F670L version 1.1.10P1N2E Description Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The...