Security advice, made clearer

The Redux Framework WordPress plugin has a medium-severity vulnerability affecting versions up to and including 4.5.15. Here is what to check and how to respond carefully.

A vulnerability has been reported in certain versions of the My Calendar plugin. It can allow a visitor who is not logged in to trigger registered WordPress shortcodes through a search parameter, potentially altering content shown on a page.

A published advisory describes a reCAPTCHA bypass in Kirki that could allow forms to be submitted without valid verification. Here is how to assess your site carefully.

A flaw in Kirki’s page API could let a user with editing access change content they do not own. Here is how to check your site and decide what to do next.

A reported vulnerability affects Gravity Forms versions up to and including 3.1.2. Here is what it means and what site owners can sensibly do next.

A high-severity MariaDB security issue could affect certain database installations. Here is what to check, and how to approach an update safely.

A flaw in MariaDB’s handling of imported MySQL tables could expose information or crash a database server. Check the affected-versions table and the publisher’s remediation guidance.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A medium-severity login protection flaw has been reported in certain releases of BlueprintUE Self-Hosted Edition. Here is what site owners should check, without assuming that exposure means compromise.

A medium-severity account-enumeration issue may let unauthenticated visitors discover whether email addresses are registered. Here is what site operators should check.

A security record describes a high-severity weakness in vtenext that could let some logged-in users access database information. Here is what site owners should check and do next.

A reported flaw in vtenext could let an unauthenticated person change account passwords. The affected releases are listed in the accompanying table; a vulnerable release is not evidence that a site has been compromised.

A medium-severity security issue in vtenext could allow script code to run in a logged-in user’s session when they are induced to submit a specially prepared request.