Security advice, made clearer

A reported high-severity privilege-escalation vulnerability affects Essential Addons for Elementor versions up to and including 6.8.7. It does not show that any particular website has been compromised.

A security advisory concerns GeoDirectory – WP Business Directory Plugin and Classified Listings Directory. Here is how to check whether it is relevant to your WordPress site and what to do next.

A vulnerability has been reported in Majestic Support – The Leading-Edge Help Desk & Customer Support for WordPress. Here is what it means and what to do next.

A security issue has been reported in Themify Builder for WordPress. Here is what it means, who may be affected and what to do next.

The Like Button Rating ♥ LikeBtn plugin has a reported stored cross-site scripting vulnerability in versions up to and including 2.6.64. Here is what to check and how to respond sensibly.

A medium-severity MariaDB server issue could expose nearby memory or cause a server crash in a specific query-cache situation. The affected versions are listed in the table below.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A published security advisory describes a command-injection weakness in Control Web Panel (CWP). Here is how to check whether it is relevant to your site and what to do next.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A medium-severity issue in the undici HTTP client for Node.js can stop a process when a cached response is replayed in a particular error condition. Affected releases and the confirmed remediation are listed in the accompanying table.

A medium-severity issue in the Node.js HTTP client undici could expose credentials in a particular redirected-request setup. Here is what site owners and developers should check.

A parsing weakness in undici can allow a response to pass a Subresource Integrity check when its digest is surrounded by certain whitespace. Here is how to assess the software on your site or application.

A reported issue in Pillow can use unusually large amounts of processor time and temporary storage when certain untrusted image files are processed. Here is how to assess it calmly.

A high-severity security issue in Pillow can affect applications that process specially prepared TIFF images. Here is what to check, without assuming that any particular website has been compromised.