Security advice, made clearer

A database-query vulnerability has been reported in JoomSport versions up to and including 5.7.14. Here is how to check your site and decide what to do next.

A medium-severity issue affects Content Egg versions up to and including 12.0.0. It concerns how some authenticated users may alter product data on posts they do not own.

NIST has recorded a medium-severity authorisation-bypass vulnerability in the Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress. No fixed version is confirmed in the supplied information.

A reported security issue affects Firelight Lightbox versions before 2.3.23. Here is what WordPress site owners need to know and what to do next.

A security advisory concerns the Page and Post Restriction plugin. Here is what site owners should check, and what the advisory does—and does not—mean.

A high-severity MariaDB security issue could affect certain database installations. Here is what to check, and how to approach an update safely.

A flaw in MariaDB’s handling of imported MySQL tables could expose information or crash a database server. Check the affected-versions table and the publisher’s remediation guidance.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A published security advisory describes a command-injection weakness in Control Web Panel (CWP). Here is how to check whether it is relevant to your site and what to do next.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A flaw in the HTTP handling of @tsparticles/mcp-server can make its Node.js service stop after receiving one malformed request. Here is how to check your installation and respond sensibly.

A publicly documented issue could allow an unauthorised file upload through a web application. Here is what site owners should check and what the available evidence does—and does not—show.

A security advisory describes a remotely exploitable SQL injection in Campcodes Division Regional Athletic Meet Game Result Matrix System. Here is how to assess what it means for your website.

A medium-severity issue can cause certain file contents to be overwritten when a saved Node.js version points through a symbolic link. Here is how to check your site or development environment safely.

A flaw in Node Version Manager can expose the contents of a file when a project supplies a symlinked .nvmrc file. Here is how to assess your setup calmly.