Security advice, made clearer

A published security report describes a payment and entitlement-checking weakness in Essential Real Estate. It does not show that any particular website has been compromised.

A published security notice describes an invoice privacy flaw in the Essential Real Estate plugin. Here is what it means and what to do next.

A published security notice concerns the WordPress plugin EWWW Image Optimizer. Here is what site owners should check, without assuming that an affected version means a site has been compromised.

A published advisory describes a weakness in the WordPress plugin’s front-end event submission process. Here is what site owners should check, without assuming that any particular site has been affected.

A published security advisory concerns the Community Events WordPress plugin. Here is what site owners should check, without assuming that any particular website has been affected.

A serious weakness in some MariaDB server releases concerns the way a special table-name prefix is handled. Here is how to check your installation and decide what to do.

A flaw in MariaDB server can mishandle a password-related permission check. The affected releases are shown in the accompanying table; this is guidance for checking, not evidence that any particular site has been compromised.

A published security advisory describes a medium-severity weakness in MariaDB’s CONNECT engine file-access functions. It may allow a low-privileged database user to read or write files beyond the intended database permissions.

A medium-severity MariaDB server vulnerability can expose memory when specially malformed spatial data is processed. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A critical vulnerability affects certain MariaDB server releases. Here is what site owners and administrators should check, without assuming that an affected release means a compromise.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A medium-severity Linux kernel issue can cause a system crash in a particular networking situation. Here is how to check your software and decide what to do next.

A reported Linux kernel vulnerability can produce inconsistent ext4 bitmap checks in a narrow timing situation. Here is what site owners should check, and what this report does—and does not—mean.

A high-severity Linux kernel vulnerability affects certain releases listed in the affected-versions table. It concerns compressed filesystem data and does not, by itself, show that any particular website has been compromised.

A high-severity Linux kernel issue concerns how certain VT-d IOMMU entries are cleared. The affected-version table shows which releases and builds need checking.

A published security issue affects some Linux kernel builds. Here is what it means for websites and servers, and how to check the position safely.