Security advice, made clearer

A low-severity issue could affect how vendor commission debt is handled when a discount coupon is used at checkout. Here is how site owners can check their position.

A reported WordPress plugin vulnerability could let an unauthenticated visitor create an administrator account. Check whether your site uses an affected release and follow the publisher’s current guidance.

A published security report describes a payment and entitlement-checking weakness in Essential Real Estate. It does not show that any particular website has been compromised.

A published security notice describes an invoice privacy flaw in the Essential Real Estate plugin. Here is what it means and what to do next.

A published security notice concerns the WordPress plugin EWWW Image Optimizer. Here is what site owners should check, without assuming that an affected version means a site has been compromised.

A MariaDB server weakness could allow a specially authorised database account to gain higher privileges. Here is how to check your setup calmly and safely.

A published security issue affects certain MariaDB server releases. It depends on a particular database permission and account setup, so checking the installed software version is the sensible first step.

A vulnerability in MariaDB server concerns how binary FRM metadata is validated. The published evidence describes a possible route to a crash or code execution when a specially crafted file is placed in the database data directory.

A high-severity MariaDB security issue could affect certain database installations. Here is what to check, and how to approach an update safely.

A flaw in MariaDB’s handling of imported MySQL tables could expose information or crash a database server. Check the affected-versions table and the publisher’s remediation guidance.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A medium-severity issue has been recorded in the Linux kernel’s AMD display code. The affected-versions section shows which versions require checking, but an affected version is not evidence that a system has been compromised.

A kernel issue involving STM32 cryptography can produce a spinlock recursion warning in interrupt mode. Here is how to check the software on a server without assuming that an affected version means a compromise.

A vulnerability in the Linux kernel could allow unsafe channel changes in particular failure conditions, potentially leading to crashes. Here is how to check what applies to your system.

A reported Linux kernel flaw concerns a display-related component. The affected-versions table shows the releases in scope; checking the exact package supplied by your operating system is the practical next step.

A high-severity issue in the Linux kernel concerns how certain display links are checked. It is relevant to the operating system beneath a website, rather than automatically proving that a site has been compromised.