Security advice, made clearer

NIST reports a medium-severity issue in Kali Forms — Contact Form & Drag-and-Drop Builder. Sites using a version before 2.4.30 should be checked, although this does not show that any particular site has been compromised.

A published security advisory concerns the Contact Form & Drag-and-Drop Builder plugin, described in the evidence as Kali Forms. Here is what site owners should check and what the finding does — and does not — mean.

A security advisory affects the Debug Log Manager plugin for WordPress in versions up to and including 2.5.2. Here is what the finding means and what to check.

A high-severity vulnerability has been reported in NextGEN Gallery versions up to and including 4.4.1. Here is what site owners and maintainers should check.

A security advisory concerns BuddyBoss Platform versions up to and including 3.6.0. Here is how to check your site and decide what to do next.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A security issue has been reported in Control Web Panel versions before 1.12. It may allow an unauthenticated request to reach user-panel functions that should require sign-in.

A flaw in older versions of the pypdf PDF library could make an application unavailable when it processes a specially crafted PDF in a particular form-processing setup.

A high-severity issue in pypdf can cause unusually long processing times when an application reads attachments embedded in a specially crafted PDF.

A high-severity issue in the pypdf PDF library can use excessive memory when an application reads specially crafted page labels. Here is what maintainers should check.

A vulnerability in versions of pypdf before 6.18.1 can be triggered by a specially crafted PDF during text extraction. Here is what website operators and developers should check.

The publisher has reported a high-severity issue in pypdf, a Python library used to read and extract text from PDF files. It is addressed in version 6.18.1.

A high-severity vulnerability has been reported in Volmarg Personal Management System through version 2.1.0. Here is what site owners and maintainers should check.

A vulnerability in Cotonti through version 1.0.0 could let an attacker predict validation tokens used for account registration and email changes. Here is what that means for site owners.

A NIST vulnerability record says GleezCMS 1.2.0 may allow a remote attacker to obtain sensitive information. A fixed release and severity rating have not been confirmed.

A vulnerability in python-jose can bypass authentication in a specific configuration. Here is what website owners and maintainers should check.

A published security advisory affects PandaWiki releases from 3.65.0 through 3.87.5. Here is what site owners should check, without assuming that an affected version has been compromised.