MicroPyramid
MicroPyramid Security Releases - October 2026
micropyramid-2026-10 Oct 1, 2026 Source: Vendor
MicroPyramid security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-110592
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2026-110592
BR2026-0000-030781
BottleCRM
unclaimed
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs...
Credited as Aaron Amran Bin Amiruddin
CVE-2026-110593
BR2026-0000-030782
BottleCRM
unclaimed
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Templ...
Credited as Aaron Amran Bin Amiruddin
CVE-2026-110594
BR2026-0000-030783
BottleCRM
unclaimed
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule reg...
Credited as Aaron Amran Bin Amiruddin
CVE-2026-110595
BR2026-0000-030784
BottleCRM
unclaimed
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass...
Credited as Aaron Amran Bin Amiruddin