Security advice, made clearer

A reported input-validation weakness in the GetPaid plugin could allow an unauthenticated visitor to bypass payment processing on a public payment form. Here is how to check your position calmly.

A published advisory describes a high-severity issue in Mobile builder for WordPress. Site owners should check the installed plugin version and follow the publisher’s current guidance.

A high-severity privilege-escalation vulnerability has been reported in the Import and export users and customers plugin for WordPress. The affected versions are listed in the accompanying table.

Slim Jetpack has a high-severity stored cross-site scripting vulnerability. Here is what site owners should check, and what the finding does — and does not — mean.

A published security advisory describes a weakness in an older range of the WordPress plugin WPvivid — Backup, Migration & Staging. Here is what site owners should check, without assuming that an attack has taken place.

A high-severity MariaDB security issue could affect certain database installations. Here is what to check, and how to approach an update safely.

A flaw in MariaDB’s handling of imported MySQL tables could expose information or crash a database server. Check the affected-versions table and the publisher’s remediation guidance.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A reported vulnerability in OPNsense core affects versions up to and including 26.7.8. Here is what it means for administrators and site owners.

A reported authentication-bypass weakness affects phpMyAdmin versions up to and including 5.2.3. Here is what to check and how to respond calmly.

A path traversal vulnerability in Moodle’s Blackboard question import format could allow authorised users with particular teaching permissions to copy server files into a draft area. The affected version list does not confirm that any individual site has been compromised.

A medium-severity vulnerability has been reported in phpMyAdmin versions up to and including 5.2.3. Here is what to check and how to respond calmly.

A reported security weakness in phpMyAdmin through version 5.2.3 could let an attacker with an already hijacked session remove two-factor authentication from that session’s account settings.