Security advice, made clearer

A security issue in Ultra Addons for Contact Form 7 can allow unauthenticated file deletion when specific PDF-generation features are enabled. Site owners should check their installation and follow the publisher’s latest guidance.

A missing authorisation check has been reported in Product Gallery Slider & Additional Variation Images for WooCommerce. Here is what the finding means and what to do next.

Media Library Assistant versions before 3.44 are listed as affected by a medium-severity access-control issue. Here is what it means and what to do next.

A WordPress plugin advisory describes a stored cross-site scripting risk in Media Library Assistant versions before 3.44. Here is what site owners should check.

A vulnerability in MapPress can allow unauthenticated visitors to retrieve users’ email addresses and display names. Website owners should check the installed version and follow confirmed guidance before making changes.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A security issue has been reported in Control Web Panel versions before 1.12. It may allow an unauthenticated request to reach user-panel functions that should require sign-in.

A flaw in the pypdf PDF library can make an application spend a long time processing a specially crafted PDF. Here is how to check whether your site uses an affected version and what to do next.

A vulnerability in older versions of the open-source pypdf library could use excessive memory when an application reads specially crafted PDF page labels. Here is what to check and how to respond calmly.

A vulnerability in versions of the open-source pypdf PDF library could make specially crafted documents use unusually large amounts of memory and processing time. Here is what to check.

A medium-severity issue in the pypdf Python library can make specially crafted PDFs use excessive processing time and memory. Here is what to check and how to respond sensibly.

A vulnerability in pypdf can make a PDF-processing operation loop indefinitely when it handles a specially crafted file. Here is what to check and what the published evidence says.

A high-severity vulnerability has been reported in Volmarg Personal Management System through version 2.1.0. Here is what site owners and maintainers should check.

A vulnerability in Cotonti through version 1.0.0 could let an attacker predict validation tokens used for account registration and email changes. Here is what that means for site owners.

A NIST vulnerability record says GleezCMS 1.2.0 may allow a remote attacker to obtain sensitive information. A fixed release and severity rating have not been confirmed.

A vulnerability in python-jose can bypass authentication in a specific configuration. Here is what website owners and maintainers should check.

A published security advisory affects PandaWiki releases from 3.65.0 through 3.87.5. Here is what site owners should check, without assuming that an affected version has been compromised.