Security advice, made clearer

A high-severity privilege-escalation flaw has been reported in the Mobile builder plugin for WordPress. Here is what site owners and maintainers should check.

A high-severity privilege-escalation vulnerability has been reported in the Import and export users and customers plugin for WordPress. The affected versions are listed in the accompanying table.

A reported vulnerability affects Stape Conversion Tracking versions before 2.3.11. Here is what site owners should check, without assuming that an affected version has been compromised.

A published security notice says EventPrime versions before 4.3.6.1 may expose content marked as awaiting review to people who are not signed in.

A reported issue could expose the title and description of non-public posts to users with relatively limited WordPress permissions. Website owners should check the installed plugin version and the publisher’s current guidance.

A flaw in MariaDB server can mishandle a password-related permission check. The affected releases are shown in the accompanying table; this is guidance for checking, not evidence that any particular site has been compromised.

A critical vulnerability affects certain MariaDB server releases. Here is what site owners and administrators should check, without assuming that an affected release means a compromise.

A MariaDB server weakness could allow a specially authorised database account to gain higher privileges. Here is how to check your setup calmly and safely.

A high-severity MariaDB security issue could affect certain database installations. Here is what to check, and how to approach an update safely.

A flaw in MariaDB’s handling of imported MySQL tables could expose information or crash a database server. Check the affected-versions table and the publisher’s remediation guidance.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A critical security issue has been reported in affected versions of Gamezone. Here is how to check your site and decide what to do next.

A published advisory identifies an unauthenticated PHP Object Injection vulnerability in Gamic. Here is how to check your site and follow the publisher’s guidance calmly.

A published vulnerability affects certain Good Homes installations. Here is what site owners and maintainers should check, and how to respond calmly.

A newly listed vulnerability affects Gunslinger installations in the affected-versions table. Here is what it means, what to check and how to proceed calmly.

A critical security issue has been reported in Zoho Flow. Here is what site owners and administrators can check, without assuming that a vulnerable version has been compromised.