Security advice, made clearer

A medium-severity issue has been reported in the WordPress plugin Image Hover Effects Ultimate. Here is what site owners should check, without assuming that any particular site has been affected.

A security advisory affects the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. Site owners should check their installed version and follow the publisher’s confirmed guidance.

A high-severity authorisation flaw has been reported in the WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin. The practical risk depends heavily on how its Data Apps are configured.

A stored cross-site scripting issue has been reported in the WordPress plugin. Here is what site owners should check and what the finding does—and does not—mean.

A published security advisory affects FunnelKit Payment Gateway for Stripe WooCommerce. Here is what store owners and site maintainers should check, without assuming that any individual site has been compromised.

A medium-severity MariaDB server issue could expose nearby memory or cause a server crash in a specific query-cache situation. The affected versions are listed in the table below.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A published security advisory describes a command-injection weakness in Control Web Panel (CWP). Here is how to check whether it is relevant to your site and what to do next.

A vulnerability in mariadb could let a malicious remote client interrupt database service in certain circumstances. Here is how to check your software and decide what to do next.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A high-severity security issue has been reported in Treeio. The affected-versions table shows which releases are covered; a vulnerable version does not, by itself, mean a site has been compromised.

A security issue has been reported in Magepeople inc. WpTravelly, a tour-booking plugin. Here is what to check and how to respond calmly.

A security advisory describes a high-severity PHP file-inclusion weakness in WpTravelly tour-booking-manager. Here is what site owners and maintainers should check.

A flaw in FileGator’s batch-download feature may let a permitted user retrieve another user’s temporary archive in a specific multi-user setup. Here is what site owners should check.

A published security advisory describes a weakness in Chartbrew’s PostgreSQL SQL-validation blocklist. The practical impact depends on how the application, database connection and database permissions are configured.