Security advice, made clearer

A published security report describes a payment and entitlement-checking weakness in Essential Real Estate. It does not show that any particular website has been compromised.

A published security notice describes an invoice privacy flaw in the Essential Real Estate plugin. Here is what it means and what to do next.

A published security notice concerns the WordPress plugin EWWW Image Optimizer. Here is what site owners should check, without assuming that an affected version means a site has been compromised.

A published advisory describes a weakness in the WordPress plugin’s front-end event submission process. Here is what site owners should check, without assuming that any particular site has been affected.

A published security advisory concerns the Community Events WordPress plugin. Here is what site owners should check, without assuming that any particular website has been affected.

A serious weakness in some MariaDB server releases concerns the way a special table-name prefix is handled. Here is how to check your installation and decide what to do.

A flaw in MariaDB server can mishandle a password-related permission check. The affected releases are shown in the accompanying table; this is guidance for checking, not evidence that any particular site has been compromised.

A published security advisory describes a medium-severity weakness in MariaDB’s CONNECT engine file-access functions. It may allow a low-privileged database user to read or write files beyond the intended database permissions.

A medium-severity MariaDB server vulnerability can expose memory when specially malformed spatial data is processed. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A critical vulnerability affects certain MariaDB server releases. Here is what site owners and administrators should check, without assuming that an affected release means a compromise.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A high-severity Linux kernel issue can cause an out-of-bounds read in the JFS file system code. Here is how to check whether your environment may be affected.

A reported Linux kernel race condition could affect certain systems running an affected release. Here is how to check your environment without jumping to conclusions.

CVE-2025-38127 concerns error handling in the Linux kernel when an XDP programme is loaded. The supplied evidence describes a possible system crash, but does not establish exploitation.

A medium-severity issue in the Linux kernel’s iwlwifi handling concerns a warning after a wireless firmware error. The affected-versions table shows the published version ranges.

A reported flaw in the Linux kernel affects certain versions and relates to how BPF array data is addressed. Here is what it means for site owners and administrators.