Security advice, made clearer

A stored cross-site scripting issue has been reported in Meta Box – WordPress Custom Fields Framework. Here is what website owners should check and how to respond calmly.

A published security advisory describes a medium-severity authorisation problem in Meta Box – WordPress Custom Fields Framework. Here is how to assess it calmly and safely.

A published security advisory concerns LeapWorx’s Premium Blocks – Gutenberg Blocks for WordPress. Here is what site owners should check and what the finding does—and does not—mean.

A published vulnerability could allow unauthorised deletion of uploaded media on WordPress sites using the affected plugin. Here is what site owners should check.

A vulnerability has been reported in the Download Manager plugin for WordPress. Here is what it means, which sites should check their setup, and how to respond carefully.

A medium-severity MariaDB server issue could expose nearby memory or cause a server crash in a specific query-cache situation. The affected versions are listed in the table below.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A published security advisory describes a command-injection weakness in Control Web Panel (CWP). Here is how to check whether it is relevant to your site and what to do next.

A vulnerability in mariadb could let a malicious remote client interrupt database service in certain circumstances. Here is how to check your software and decide what to do next.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A vulnerability in certain versions of the open-source Python PDF libraries pypdf and pypdf2 could make processing a specially crafted PDF keep running indefinitely. Here is how to check what your website uses and what to do next.

A high-severity security issue has been reported in Treeio. The affected-versions table shows which releases are covered; a vulnerable version does not, by itself, mean a site has been compromised.

A flaw in FileGator’s batch-download feature may let a permitted user retrieve another user’s temporary archive in a specific multi-user setup. Here is what site owners should check.

A published security advisory describes a weakness in Chartbrew’s PostgreSQL SQL-validation blocklist. The practical impact depends on how the application, database connection and database permissions are configured.

A medium-severity issue in the Urwid Python console interface library affects software before the fixed release shown in the affected-versions table. It may cause certain web display requests to fail and, with repeated requests, contribute to a denial-of-service condition.

A flaw in some Velociraptor releases could allow unintended database connections and, in particular circumstances, access to files or creation of files. Here is how to assess the practical risk.