Security advice, made clearer

A medium-severity access-control issue has been reported in Premium Blocks – Gutenberg Blocks for WordPress. Site owners should check the installed software version and the publisher’s current guidance.

A stored cross-site scripting issue has been reported in Zephyr Project Manager, a WordPress plugin. Site owners should compare their installed version with the affected-versions table and follow the publisher’s current guidance.

A security issue in the wpForo Forum WordPress plugin could allow certain logged-in users to place scripts in forum content. Here is what to check and how to respond calmly.

A published security advisory says YML for Yandex Market can expose a stored Yandex Market API key through a public log file when particular plugin settings are enabled.

A reported vulnerability in the WordPress plugin could allow an unauthenticated visitor to read sensitive database information. Here is what site owners and maintainers should check.

A medium-severity MariaDB server issue could expose nearby memory or cause a server crash in a specific query-cache situation. The affected versions are listed in the table below.

A high-severity issue in the CONNECT engine affects certain MariaDB server releases. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A published security advisory describes a command-injection weakness in Control Web Panel (CWP). Here is how to check whether it is relevant to your site and what to do next.

A vulnerability in mariadb could let a malicious remote client interrupt database service in certain circumstances. Here is how to check your software and decide what to do next.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A flaw in older versions of the pypdf PDF library could make an application unavailable when it processes a specially crafted PDF in a particular form-processing setup.

A high-severity issue in pypdf can cause unusually long processing times when an application reads attachments embedded in a specially crafted PDF.

A high-severity issue in the pypdf PDF library can use excessive memory when an application reads specially crafted page labels. Here is what maintainers should check.

A vulnerability in versions of pypdf before 6.18.1 can be triggered by a specially crafted PDF during text extraction. Here is what website operators and developers should check.

The publisher has reported a high-severity issue in pypdf, a Python library used to read and extract text from PDF files. It is addressed in version 6.18.1.

A high-severity access-control issue in OpenEMR could let a low-privilege signed-in user damage laboratory-ordering configuration under specific conditions. A vulnerable version is not evidence that a site has been compromised.

A medium-severity access-control issue in OpenEMR could let a low-privilege signed-in user search for personal details without the required authorisation check.

A weakness in OpenEMR’s patient search controls may allow an authenticated user without a clinical role to view sensitive patient details. Here is what site owners should check.

A security issue in OpenEMR can let a low-privilege signed-in user reassign documents to patients or categories they can access. Here is how to assess your installation calmly and safely.

A security issue in OpenEMR can let an unauthenticated network user view information about configured sites. Here is what administrators should check and how to respond calmly.