Security advice, made clearer

A security issue in the Popup Builder plugin affects versions up to and including 4.4.5. Site owners should check their installed version and follow the publisher’s current guidance.

A published vulnerability affects Seraphinite Accelerator versions up to and including 2.29.24, but only when its Object Cache feature is enabled. Here is how to check your site calmly and safely.

A published security advisory describes a stored cross-site scripting flaw in Welcart e-Commerce versions up to and including 2.12.5. Here is what to check and what the finding does — and does not — mean.

Public vulnerability records describe a stored cross-site scripting issue in Shipping Zones by Drawing for WooCommerce. Here is what it means for WordPress and WooCommerce site owners.

ThirstyAffiliates versions up to and including 3.12.1 are listed as vulnerable to CVE-2026-119089, a high-severity issue with specific conditions for exploitation. A fixed release has not been confirmed in the supplied information.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A medium-severity issue in Control Web Panel affects versions before 1.29. There is no confirmed fixed release in the available evidence, so site owners should check the publisher’s current guidance before making changes.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A vulnerability in versions of the pypdf Python library before 6.1.3 could cause unusually high memory use when a specially crafted PDF is processed. Here is how to assess whether it is relevant to your website or application.

A security issue in versions of the open-source pypdf library before 6.0.0 could allow a specially crafted PDF to exhaust a server’s available memory. Here is what site owners and maintainers should check.

A vulnerability in pypdf can make a carefully crafted PDF trap the process in an infinite loop. Here is how to check whether your application uses an affected release and what to do next.

A flaw in the pypdf PDF library can make a process stop responding when it handles a specially crafted PDF. Here is how to check what your site uses and what to do next.

A flaw in the pypdf PDF library can make a process spend an unexpectedly long time handling a specially crafted PDF. Here is how to check what your site uses and what to do next.

A high-severity issue in OAuthLib can affect applications using a particular device-authorisation workflow. Here is what the published evidence means and what to do next.

A high-severity security issue affects certain GraphQL Tools releases when untrusted incremental GraphQL responses are processed. Here is what it means and what to do next.

A reported issue in Pillow can use unusually large amounts of processor time and temporary storage when certain untrusted image files are processed. Here is how to assess it calmly.

A high-severity security issue in Pillow can affect applications that process specially prepared TIFF images. Here is what to check, without assuming that any particular website has been compromised.

A reported security flaw in OpenEMR could leave patient documents temporarily exposed through a predictable public file address. Affected releases are listed in the accompanying table.