Security advice, made clearer

A stored cross-site scripting issue has been reported in Meta Box – WordPress Custom Fields Framework. Here is what website owners should check and how to respond calmly.

A published security advisory describes a medium-severity authorisation problem in Meta Box – WordPress Custom Fields Framework. Here is how to assess it calmly and safely.

A published security advisory concerns LeapWorx’s Premium Blocks – Gutenberg Blocks for WordPress. Here is what site owners should check and what the finding does—and does not—mean.

A vulnerability has been reported in the Download Manager plugin for WordPress. Here is what it means, which sites should check their setup, and how to respond carefully.

Public vulnerability records describe a stored cross-site scripting issue in the WordPress plugin Active Woot Products Tables for WooCommerce. 100% FREE. Here is what site owners should check.

A medium-severity MariaDB server issue could expose nearby memory or cause a server crash in a specific query-cache situation. The affected versions are listed in the table below.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A published security advisory describes a command-injection weakness in Control Web Panel (CWP). Here is how to check whether it is relevant to your site and what to do next.

A vulnerability in mariadb could let a malicious remote client interrupt database service in certain circumstances. Here is how to check your software and decide what to do next.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A vulnerability in versions of the pypdf Python library before 6.1.3 could cause unusually high memory use when a specially crafted PDF is processed. Here is how to assess whether it is relevant to your website or application.

A security issue in versions of the open-source pypdf library before 6.0.0 could allow a specially crafted PDF to exhaust a server’s available memory. Here is what site owners and maintainers should check.

A vulnerability in pypdf can make a carefully crafted PDF trap the process in an infinite loop. Here is how to check whether your application uses an affected release and what to do next.

A flaw in the pypdf PDF library can make a process stop responding when it handles a specially crafted PDF. Here is how to check what your site uses and what to do next.

A flaw in the pypdf PDF library can make a process spend an unexpectedly long time handling a specially crafted PDF. Here is how to check what your site uses and what to do next.

A high-severity security issue has been reported in Treeio. The affected-versions table shows which releases are covered; a vulnerable version does not, by itself, mean a site has been compromised.

A flaw in FileGator’s batch-download feature may let a permitted user retrieve another user’s temporary archive in a specific multi-user setup. Here is what site owners should check.

A published security advisory describes a weakness in Chartbrew’s PostgreSQL SQL-validation blocklist. The practical impact depends on how the application, database connection and database permissions are configured.

A medium-severity issue in the Urwid Python console interface library affects software before the fixed release shown in the affected-versions table. It may cause certain web display requests to fail and, with repeated requests, contribute to a denial-of-service condition.

A flaw in some Velociraptor releases could allow unintended database connections and, in particular circumstances, access to files or creation of files. Here is how to assess the practical risk.