Security advice, made clearer

The Contact Form Extender for Divi Builder plugin has a reported vulnerability affecting versions up to and including 1.0.6. A fixed release has not been confirmed in the supplied information.

A medium-severity vulnerability affects JetFormBuilder versions up to and including 3.6.2, but only under a specific JetEngine and form configuration.

A published security advisory describes a high-severity account-takeover weakness in SureCart versions up to and including 4.9.5. Here is what site owners can check and do next.

A published vulnerability in the WordPress Easy Digital Downloads plugin could allow an unauthenticated checkout user to take over an administrator account in certain payment flows.

A published security advisory affects Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning in versions up to and including 4.0.1. Here is what it means and what to do next.

A reported vulnerability in Froxlor before version 2.3.15 could let logged-in customers create MySQL databases even when an administrator had disabled that feature.

A high-severity information-disclosure issue in Froxlor could expose API credentials to administrators with a particular permission. Here is what website owners should check.

A published advisory describes a high-severity SQL injection issue in Control Web Panel (CWP) versions before 1.16. Here is what to check and what the finding does—and does not—tell you.

A vulnerability has been reported in Control Web Panel (CWP) versions before 1.16. Here is what site owners and administrators should check, and what the report does—and does not—show.

A security issue has been reported in Control Web Panel versions before 1.12. It may allow an unauthenticated request to reach user-panel functions that should require sign-in.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A published security advisory affects pypdf versions before 6.21.3. It concerns how the Python library reads certain PDF page labels, rather than proving that any particular website has been compromised.

A security issue in the pypdf PDF library can cause an application to get stuck when handling specially crafted PDF-related data. Here is what to check and what to do next.

A publicly listed vulnerability affects Motorix versions up to and including 1.11. Here is what site owners should check, without assuming that a vulnerable version has been compromised.

A public security record describes a critical unauthenticated PHP object injection issue affecting Mission versions up to and including 1.22. Here is how to check your position calmly and safely.

A public vulnerability record identifies a high-severity issue in YayMail versions up to and including 4.4.6. Here is how to assess what it means for your site.

A serious vulnerability has been reported in Langflow versions beginning with 1.0.0 and before the stated boundary. It affects how public workflows can handle pre-existing Python component code.

A high-severity vulnerability has been recorded for the Finale Lite shop manager component in versions up to and including 2.21.0. Affected-version status alone does not show that a website has been compromised.