Security advice, made clearer

A reported issue in the Dokan WordPress plugin could affect how a vendor’s unpaid commission is reconciled when a discount coupon is used at checkout. Here is how to check your position without jumping to conclusions.

A published security notice concerns the WordPress plugin Security For WooCommerce. The affected-versions table shows which releases are in scope; no particular website should be assumed affected or compromised without checking.

A published security advisory concerns Essential Real Estate, a WordPress plugin used for property listings. Here is what the finding means and what to do next.

A published advisory describes a missing ownership check in the Essential Real Estate WordPress plugin. It could let a logged-in, low-permission user view another user’s invoice details.

A reported issue in the EWWW Image Optimizer WordPress plugin could let certain authenticated users place scripts in page content. Here is what site owners should check.

A medium-severity MariaDB server issue could expose nearby memory or cause a server crash in a specific query-cache situation. The affected versions are listed in the table below.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A published security advisory describes a command-injection weakness in Control Web Panel (CWP). Here is how to check whether it is relevant to your site and what to do next.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A flaw in Pillow’s handling of certain multi-frame images can cause memory errors and, in specific demonstrated runtime profiles, command execution. Website owners should check whether an affected version is installed.

A reported flaw in the Pillow imaging library can cause a Python application to stop responding in a particular archive-reading situation. It is relevant mainly where code directly uses Pillow’s TarIO component.

A vulnerability in older versions of the Python imaging library Pillow can cause excessive memory use when certain multi-frame images are opened and processed.

A security issue in the toml-node parser can make a Node.js process unresponsive when it handles a specially prepared TOML document. Here is how to check what version is in use and what to do next.

A reported resource-exhaustion weakness in Apache bRPC can cause disproportionate memory use and process crashes. Here is how to check your exposure carefully.