Security advice, made clearer

A public vulnerability record affects WP Directory Kit versions up to and including 1.6.0. Site owners should check the installed version and follow confirmed guidance from the plugin publisher.

A security record describes a stored cross-site scripting flaw in the GeoDirectory WordPress plugin. Here is what site owners should check and how to respond calmly.

A reflected cross-site scripting issue affects versions up to and including 3.3.2 of WooCommerce Extra Product Options Pro. Here is what site owners should check and do next.

Security researchers have reported a medium-severity vulnerability in Ninja Forms versions up to and including 3.15.5. Here is what site owners should check and do next.

A published advisory says SimpleForm versions up to and including 3.10.2 have a critical file-upload vulnerability. Website owners should check their installed version and follow the publisher’s latest guidance.

A MariaDB server issue could allow specially crafted database objects to introduce SQL statements when generated SQL is later used. Here is what to check and how to respond calmly.

A critical vulnerability in MariaDB’s GIS handling could allow memory corruption and, in combination with another vulnerability, potentially code execution. Here is what site owners should check.

A MariaDB vulnerability could allow an attacker to access files, corrupt data, crash a server or run code when a specially formed table name is used. Check which version is installed and follow MariaDB’s confirmed remediation.

A high-severity MariaDB server vulnerability can cause an authorisation error in a particular account-management statement. Here is what to check and what the finding does—and does not—mean.

A high-severity MariaDB vulnerability involves validation of metadata in binary FRM files. Check the server version and follow MariaDB’s confirmed update guidance.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A vulnerability in pypdf versions before 6.21.3 can make an application spend excessive time and memory processing a specially crafted encrypted PDF. Here is what website and application owners should check.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A published security advisory affects pypdf versions before 6.21.3. It concerns how the Python library reads certain PDF page labels, rather than proving that any particular website has been compromised.

A high-severity vulnerability has been reported in Volmarg Personal Management System through version 2.1.0. Here is what site owners and maintainers should check.

A vulnerability in Cotonti through version 1.0.0 could let an attacker predict validation tokens used for account registration and email changes. Here is what that means for site owners.

A NIST vulnerability record says GleezCMS 1.2.0 may allow a remote attacker to obtain sensitive information. A fixed release and severity rating have not been confirmed.

A vulnerability in python-jose can bypass authentication in a specific configuration. Here is what website owners and maintainers should check.

A published security advisory affects PandaWiki releases from 3.65.0 through 3.87.5. Here is what site owners should check, without assuming that an affected version has been compromised.