Security advice, made clearer

A security issue in Ultra Addons for Contact Form 7 can allow unauthenticated file deletion when specific PDF-generation features are enabled. Site owners should check their installation and follow the publisher’s latest guidance.

A missing authorisation check has been reported in Product Gallery Slider & Additional Variation Images for WooCommerce. Here is what the finding means and what to do next.

Media Library Assistant versions before 3.44 are listed as affected by a medium-severity access-control issue. Here is what it means and what to do next.

A WordPress plugin advisory describes a stored cross-site scripting risk in Media Library Assistant versions before 3.44. Here is what site owners should check.

A vulnerability in MapPress can allow unauthenticated visitors to retrieve users’ email addresses and display names. Website owners should check the installed version and follow confirmed guidance before making changes.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A security issue has been reported in Control Web Panel versions before 1.12. It may allow an unauthenticated request to reach user-panel functions that should require sign-in.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A vulnerability in pypdf versions before 6.21.3 can make an application spend excessive time and memory processing a specially crafted encrypted PDF. Here is what website and application owners should check.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A published security advisory affects pypdf versions before 6.21.3. It concerns how the Python library reads certain PDF page labels, rather than proving that any particular website has been compromised.

A vulnerability in WeGIA versions before 3.8.7 affects how memorandum text is stored and displayed. Here is what site operators should check and what the finding does—and does not—mean.

A medium-severity issue in the Python library joserfc can increase memory use when specially formed signed tokens are processed. Here is what maintainers should check.

A vulnerability in the Python joserfc library could allow repeated requests to consume the CPU of a service handling certain encrypted messages. The publisher’s evidence says the issue is fixed in version 1.7.5.

A vulnerability in the pyasn1 library can make certain ASN.1 data take an unusually long time to decode. Here is what site owners and developers should check.

A flaw in the Python ASN.1 library pyasn1 can make decoding specially prepared data consume excessive processor time. The publisher evidence identifies version 0.6.5 as the fix.