Security advice, made clearer

A reported vulnerability affects Stape Conversion Tracking versions before 2.3.11. Here is what site owners should check, without assuming that an affected version has been compromised.

A published security notice says EventPrime versions before 4.3.6.1 may expose content marked as awaiting review to people who are not signed in.

A reported issue could expose the title and description of non-public posts to users with relatively limited WordPress permissions. Website owners should check the installed plugin version and the publisher’s current guidance.

A security advisory affects All-in-One Video Gallery versions before 5.0.0. Here is what the finding means and the sensible next steps for site owners.

A published vulnerability affects versions of the VikWidgetsLoader WordPress plugin before 1.12.3. Here is what site owners should check and why the finding does not by itself show that a site has been compromised.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A security issue has been reported in Control Web Panel versions before 1.12. It may allow an unauthenticated request to reach user-panel functions that should require sign-in.

A vulnerability in versions of the open-source pypdf PDF library could make specially crafted documents use unusually large amounts of memory and processing time. Here is what to check.

A medium-severity issue in the pypdf Python library can make specially crafted PDFs use excessive processing time and memory. Here is what to check and how to respond sensibly.

A vulnerability in pypdf can make a PDF-processing operation loop indefinitely when it handles a specially crafted file. Here is what to check and what the published evidence says.

A security issue in older versions of the pypdf PDF library can make processing a specially crafted document take an unusually long time. Here is how to check whether it is relevant to your site or application.

A vulnerability in the pypdf PDF library can cause unusually high memory use when a specially crafted PDF is processed. Here is how to assess whether it matters to your site or application.

A vulnerability in the Python joserfc library could allow repeated requests to consume the CPU of a service handling certain encrypted messages. The publisher’s evidence says the issue is fixed in version 1.7.5.

A vulnerability in the pyasn1 library can make certain ASN.1 data take an unusually long time to decode. Here is what site owners and developers should check.

A security advisory concerns pyasn1 versions before 0.6.5. Here is what site owners and developers should check, without assuming that an affected version has been compromised.

A security advisory describes an unauthenticated PHP object injection issue in Gamezone versions up to and including 1.1.11. No fixed release is confirmed in the available information.

A public advisory describes a critical unauthenticated PHP object injection vulnerability in Gunslinger versions up to and including 1.11. Here is how to check your position without jumping to conclusions.