Security advice, made clearer

Public security records describe a medium-severity issue in versions up to and including 3.4.6. It can expose information about non-public WooCommerce products and place unnecessary load on a site.

Public vulnerability records describe a medium-severity stored cross-site scripting issue in W3 Total Cache versions up to and including 2.10.7. Here is what to check and how to respond calmly.

A published security advisory affects the Mail logging & Catcher WordPress plugin up to and including version 2.2.0. Here is what to check and what the advisory does—and does not—tell us.

A security issue in the Popup Builder plugin affects versions up to and including 4.4.5. Site owners should check their installed version and follow the publisher’s current guidance.

A published vulnerability affects Seraphinite Accelerator versions up to and including 2.29.24, but only when its Object Cache feature is enabled. Here is how to check your site calmly and safely.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A security issue has been reported in Control Web Panel versions before 1.12. It may allow an unauthenticated request to reach user-panel functions that should require sign-in.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A published security advisory affects pypdf versions before 6.21.3. It concerns how the Python library reads certain PDF page labels, rather than proving that any particular website has been compromised.

A security issue in the pypdf PDF library can cause an application to get stuck when handling specially crafted PDF-related data. Here is what to check and what to do next.

A vulnerability can leave a user’s existing database connection active after their access is removed. Administrators should check their installed version and the publisher’s latest remediation guidance.

A high-severity vulnerability has been reported in MONAI 1.6.0 and earlier than 1.6.1. The publisher’s current remediation guidance should be checked before making changes.

A reported vulnerability in OPNsense core affects versions up to and including 26.7.8. Here is what it means for administrators and site owners.

A reported authentication-bypass weakness affects phpMyAdmin versions up to and including 5.2.3. Here is what to check and how to respond calmly.

A path traversal vulnerability in Moodle’s Blackboard question import format could allow authorised users with particular teaching permissions to copy server files into a draft area. The affected version list does not confirm that any individual site has been compromised.